Management Interface Permitted IP Addresses & other devices

[stevenkadish]

Hello all,

Our PAN-OS Management Interface Permitted IP Addresses (on both Panorama and firewalls, version 8.14) contain IPs for the firewalls and both members of the Panorama cluster.  These weren't set up by me and I'm wondering if that's necessary.  I have read an article that said that that device configs, log retrieval, etc. are managed over that interface.  So, does every Panorama and firewall have to have every other Panorama and firewall in its access list?

Also, is there a trick anyone knows of to make it easy to copy those access lists from device to device?

Any help is appreciated.

Thanks in advance,

- Steve

[BPry · Accepted solution]

@stevenkadish,

This depends on how you actually have things configured; a lot of the time you wouldn't need to add all of the other firewalls into the permitted-ip list on the other firewalls. That being said, they could be using user-id redistribution or using it as a backup management access solution or something like that. 

The easiest answer really is that managing this through the API or the XML is going to be the easiest solution I've found for managing this. It's easy enough to do in the API for each firewall, or if you're working in the XML configuration file already it's extremely easy. 

[stevenkadish]

Thanks, @BPry .  From the configuration I've done since I got your response, I haven't had any problems if I omit the firewalls from the access lists.  I'm using the XML files to configure them, which is certainly easier!