Using firewall's own loopbacks as dummy Panorama servers

[salzmant]

Hello,

was trying to find if anyone has ever dealt with something similar, but couldn't find anything (so, hopefully this isn't a duplicate post).

Some info to put things into perspective:

I was tasked to migrate 6 HA (active-passive) clusters from soon-to-be-decommissioned Panorama (hosted in Azure) to our on-prem Panorama (hosted in DC) - all the device groups, templates, template-stacks, etc. were successfully migrated and prepared already. All the firewalls, have their own public IP and right now connect to the current Panorama via public IP (through the internet). Management and Untrust (internet facing) dataplane interfaces have IPs from the same subnet.

The new Panorama is not publicly accessible from the internet due to company policies (MGMT network, where Panorama and jump servers are, not being opened from the internet). I have built an IPSec tunnel between the firewalls and VPN GW (hosted in the same MGMT network as Panorama) to route the FW->Panorama traffic through it.

Now, since the new Panorama IP address is not routed towards the firewall (to then continue into the IPsec tunnel), but instead goes via default route into the internet and the customer/their ISPs were not keen to route it to my firewall (due to some concerns about it being propagated further, etc.) I have been given IP, from the same public subnet as where the FW management and dataplane Untrust interfaces are so that I would use it to DNAT that Panorama IP. Meaning, I created loopback interface on the firewall, which would be reachable from the management interface and created NAT policies.

Example IP addresses:

FW Management interface IP -> 11.11.11.1

Loopback IP -> 11.11.11.2

Real Panorama IP -> 192.168.0.1

Logic is that on the firewall I'd configure Panorama server to be (11.11.11.2) and I'd have a NAT (both SNAT+DNAT) policy to then translate the 11.11.11.2 (Loopback) to 192.168.0.1 (Panorama), which would be then routed into the tunnel (as I can't use 192.168.0.1 directly for Panorama on the firewall).

When I however try this approach, it doesn't seem to work -> I can't see anything in the dataplane traffic logs and also when I tried packet capture directly on the management interface.

The only thing I can see is this in ms.log (IP changed to reflect example IPs above):

2026-08-27 06:13:13.154 -0400 Error: pan_comm_get_tcp_conn_gen(comm_utils.c:881): COMM: cannot connect. remote ip=11.11.11.2 port=3978 err=Connection timed out(110) sock=30
2026-08-27 06:15:32.418 -0400 Error: pan_comm_get_tcp_conn_gen(comm_utils.c:881): COMM: cannot connect. remote ip=11.11.11.2 port=3978 err=Connection timed out(110) sock=30
2026-08-27 06:17:51.682 -0400 Error: pan_comm_get_tcp_conn_gen(comm_utils.c:881): COMM: cannot connect. remote ip=11.11.11.2 port=3978 err=Connection timed out(110) sock=30
2026-08-27 06:20:10.946 -0400 Error: pan_comm_get_tcp_conn_gen(comm_utils.c:881): COMM: cannot connect. remote ip=11.11.11.2 port=3978 err=Connection timed out(110) sock=30
2026-08-27 06:22:30.210 -0400 Error: pan_comm_get_tcp_conn_gen(comm_utils.c:881): COMM: cannot connect. remote ip=11.11.11.2 port=3978 err=Connection timed out(110) sock=31
2026-08-27 06:24:49.474 -0400 Error: pan_comm_get_tcp_conn_gen(comm_utils.c:881): COMM: cannot connect. remote ip=11.11.11.2 port=3978 err=Connection timed out(110) sock=30
2026-08-27 06:27:08.738 -0400 Error: pan_comm_get_tcp_conn_gen(comm_utils.c:881): COMM: cannot connect. remote ip=11.11.11.2 port=3978 err=Connection timed out(110) sock=30
2026-08-27 06:29:28.003 -0400 Error: pan_comm_get_tcp_conn_gen(comm_utils.c:881): COMM: cannot connect. remote ip=11.11.11.2 port=3978 err=Connection timed out(110) sock=30
2026-08-27 06:31:47.266 -0400 Error: pan_comm_get_tcp_conn_gen(comm_utils.c:881): COMM: cannot connect. remote ip=11.11.11.2 port=3978 err=Connection timed out(110) sock=30

So, TLDR my question is - is it not possible to use firewall's own interface IP address to serve as a "dummy" Panorama server? Even though management plane and dataplane are split, so I'd assume it wouldn't care about that?

Also - changing service routes from the default (management) interface to some of the dataplane interfaces is not really preferred as then the Passive firewall node wouldn't be connected to Panorama.

Thank you all in advance. Might be quite dirty approach, but given the topology, etc. this seemed to be the best one. Also I am aware that I might have described the situation confusingly, so sorry about that, but I'm quite lost with this case.