Management access for permitted IPs

[josggf]

hi

i am trying to add 10/8 as premitted IP subnet in mgmt interface but it seems to not work? anyone else has experienced this?

[Mick_Ball]

I do not restrict management to specific ip’s but it’s my understanding that this option is for host addresses, not entire ranges.

[josggf]

I will recheck but I think it works for a /24

[OtakarKlier]

Hello,

One approach is to use the PAN itself to secure the management interface. Meaning you put the management interface into a zone that is managed by the PAN so then you can use all sorts of different options to secure the management interface, i.e. source/destination IP, zone, user-id, etc.

Cheers!

[Mick_Ball]

yes good point @OtakarKlier but our policies only permit out of band management.

perhaps @josggf has the management interface connected to the user or trusted LAN and therefore your suggestion would be best.

[BPry]

@josggf,

What's the point of even putting in permitted IPs if you're enabling an entire /8 network? Regardless, 8.1.* and 8.0.* will allow you to do this perfectly fine without complaint, are you trying to actually include '10/8' or '10.0.0.0/8', because it would need to be the second option.