Management Interface Permitted IP Addresses & other devices

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Management Interface Permitted IP Addresses & other devices

L2 Linker

Hello all,

 

Our PAN-OS Management Interface Permitted IP Addresses (on both Panorama and firewalls, version 8.14) contain IPs for the firewalls and both members of the Panorama cluster.  These weren't set up by me and I'm wondering if that's necessary.  I have read an article that said that that device configs, log retrieval, etc. are managed over that interface.  So, does every Panorama and firewall have to have every other Panorama and firewall in its access list?

 

Also, is there a trick anyone knows of to make it easy to copy those access lists from device to device?

 

Any help is appreciated.

 

Thanks in advance,

- Steve

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

@stevenkadish,

This depends on how you actually have things configured; a lot of the time you wouldn't need to add all of the other firewalls into the permitted-ip list on the other firewalls. That being said, they could be using user-id redistribution or using it as a backup management access solution or something like that. 

 

The easiest answer really is that managing this through the API or the XML is going to be the easiest solution I've found for managing this. It's easy enough to do in the API for each firewall, or if you're working in the XML configuration file already it's extremely easy. 

View solution in original post

2 REPLIES 2

Cyber Elite
Cyber Elite

@stevenkadish,

This depends on how you actually have things configured; a lot of the time you wouldn't need to add all of the other firewalls into the permitted-ip list on the other firewalls. That being said, they could be using user-id redistribution or using it as a backup management access solution or something like that. 

 

The easiest answer really is that managing this through the API or the XML is going to be the easiest solution I've found for managing this. It's easy enough to do in the API for each firewall, or if you're working in the XML configuration file already it's extremely easy. 

Thanks, @BPry .  From the configuration I've done since I got your response, I haven't had any problems if I omit the firewalls from the access lists.  I'm using the XML files to configure them, which is certainly easier!

 

  • 1 accepted solution
  • 4100 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!