PA-500 Virtual Wire implementation (HA)

[fonasupport]

I am planning a deployment of two PA-500's for just Threat Prevention and URL monitoring.  I am working through the best way to do it for physical cabling and figuring out where everything should go.  I would also like to use the Active Directory integration to base URL Filtering policies to groups/users.  My question is, will I need to connect another interface to my internal network for it to access my domain controllers?  I've gone through the Palo Alto documentation and it somewhat describes it but I'm still a little unclear of this simple implementation.

[UhMayYeah · Accepted solution]

By default management interface is chosen and should have access to your DC.

If your network design cannot allow this access.You can configure a L3 interface and change the service route going to :

Device > Setup > Services>Service RouteConfiguration.

[torm]

There is something called virtual wire subinterface introduces in PANOS 5.0. However I don't think it's possible to have a layer3 wvire subinterface, but I'm not 100% sure.

I would say your best option is to use the management interface, as you probably want to have management access to the device anyway.

[fonasupport]

Ok, so now I am to the point on applying my licenses.  Right now I just have the Management Port plugged in and that network does have routing to the domain controllers (for DNS) and the Internet.  If I try to either "Retrieve license key from license server" or "Activate deature using auth code" (which I have all the codes) it fails to install the licenses. 

If I create and connect a Layer 3 interface do I need to setup a new Zone and create a policy allowing it out?

[Abs]

You need to ensure that the management interface has access to the Internet for this to work, as it connects to Palo Alto's servers. Alternately, you can download the licenses from the My Devices page by registering your device and then clicking the , and upload them to the firewall.

[fonasupport]

I was able to get it to work by setting the DNS and Palo Alto Updates to go out the MGT port.  I forgot the changes don't take full effect until I click Commit too...

Once I did that I was able to install the license files.