Mgmt Traffic over VPN

[D.Callahan]

Hi All,

  I am looking to deploy a few (4) PA-440's into the field. What is the best way to configure my remote firewalls to send MGMT traffic 3.3.3.3/24 (using loopback) over a vpn to central firewall to pass along to panorama MGMT (10.10.10.10/24)  to receive to traffic to manage them remotely.

Thanks for the help.   

[PavelK]

Hello @D.Callahan

thanks for post!

To send management traffic over loopback interface instead of management port, you will have to setup service route: Setting a Service Route for Services to Use a Dataplane's Interface from the Web UI and CLI. If your management interface is completely disconnected / unused, please set all services to used loopback interface. If you are planning to use both management interface as well we loopback interface, then you can set only "panorama" for service route. Please note that even though Firewall is registered to Panorama with data plane interface (loopback) in your case, the Firewall registered IP address on Panorama side is still showing management interface: When Firewall's service route is configured with ethernet interface for Panorama, why is Panorama di....

Make sure that loopback IP address is advertised to over VPN tunnel that Panorama knows how to reach it.

When it comes to securing management traffic Palo Alto has best practice guide: Deploy Administrative Access Best Practices. The best is to have dedicated out of band management network, however if you have only a single VPN tunnel the options are limited.

Kind Regards

Pavel   

[D.Callahan]

i @PavelK Thanks for the reply!!

I will review everything and let you know how that works out.

Thank you again.