Management Interface

[Huddlebuy]

Hi, Is it a good idea to connect the mgmt interface directly to wan ? or should it only be accessible locally and via an access server for remote management ?

[santonic · Accepted solution]

It's a very bad idea.

If you really want mgmt access directly from WAN; put management profile on some other L3 interface connected to WAN and restrict access within management profile and with firewall rules. This way you can also put security profiles on this rule, zone protection etc.

[Ben-W]

Hi Huddlebuy,

Personally I like to setup GlobalProtect for businesses which require remote management to the PA firewalls.. As you get a single free portal and gateway license prior to version 7 (Portal license is free).

Setup GlobalProtect and enable HTTPS and/or SSH in an interface management profile and add to the GlobalProtect Tunnel Interface.

Hope this helps.

regards,

Ben

[Brandon_Wertz]

I'd go a step further and restrict access for a specific set of IPs or Networks.

[santonic]

Yeah, for normal everyday access to firewall VPN client and accessing mgmt interface in LAN is the way to go. But access directly from WAN is typcially needed when something is wrong with the firewall. In that case GP might not be working and you won't be able to use such access. Then a mgmt access to WAN is needed but should only be allowed from a few IPs.

[Huddlebuy]

Thanks guys; will be configuring it behind a firewall on the OOBM link.