Panorama device management via loopback

[Baddogsettle]

I have remote PA firewalls deployed with IPSec tunnels back to our data center firewalls. The remote management interface is not used; I created a loopback and configured all service route items to use the loopback. However, in Panorama Managed Device Summary, it still shows the remote management interface IP (which is not connected to anything). 

How can I change to Panorama shows the loopback IP in Device Management?

[RamprakashRT]

Hi , 

Please make sure that loopback IP is reachable to Panorma on required ports and Viceversa.

If NAT is involved make sure it is bidirectional NAT as communication between Panorma and firewall is bidirectional.

Thanks,

Ram

[Remo · Accepted solution]

Hi @Baddogsettle 

This isn't possible. In panorama you will always see the management IP. Specially in case of an active passive HA cluster you would have the same loopback interface and IP ond both firewalls, then it would be somehow wrong to show both firewalls with the same loopback IP in panorama (besides the fact, that in this case it simply wouldn't really work).

@RamprakashRT You are right, the communication is bidirectional, but the connection is initiated from the firewall towards panorama and not otherwise. Over this connection coming from the firewall, panorama is then able to connect back to the firewall (for pushing updates, context switch to the firewall, ...)

[RamprakashRT]

Hi @Remo 

Thanks for the clarification , got it now.

Thanks,

Ram