What services are used by the Management port?

[kjsocher]

We have been tasked to follow the CIS benchmark for our Palo Alto firewalls. One item is to limit access to specific IP addresses for the Management port. That is easy enough if the only thing using the management port was users connecting to manage the firewall itself. My question is what other services use the management port (Panorama, User-ID agents on other servers, HA configurations, external monitoring systems, automation)?

[OtakarKlier]

Hello,

Of the list you proved, they all use the management port, HA to a lesser extent on the larger models. May be this will help[ answer your questions?

Panorama, User-ID agents on other servers, HA configurations, external monitoring systems, automation

Regards,

[acc6d0b3610eec313831f7900fdbd235]

Hi @kjsocher

The management port supports the following services by default: HTTP, HTTP OCSP, HTTPS, Telnet, SSH, Ping, SNMP, User-ID, User-ID Syslog Listener SSL, and User-ID Syslog Listener-UDP.

Additional services using the management port by default can be checked by going to: Setup --> Services --> Service Route Configuration

Note that if you have services that you do not want to go through the management port, you can always change it and set it to go through one of your data ports; however, bear in mind that by doing so, that traffic is now going through the data plane instead of the management plane; hence, if that service is critical for your environment and there is a unilateral failure of the data plane that service will no longer be available. Finally, if you decide to put that traffic over the data plane, now you will have to enforce it via specific security rules.

More details can be found at: https://www.paloaltonetworks.com/documentation/60/pan-os/pan-os/getting-started/set-up-management-ac...

I hope this helps.

[Remo]

Hi @kjsocher

When you limit the access on the managemdnt port to specific ip addresses, it really depends on what services you have activated (ssh, https, snmp, ...). But for tje ip addresses you have to configure you only need to specify rhe ones which connect TO the mgmt ip address --> the access list only applies to incoming traffic. Outgoing traffic will still be allowed to dst's which you do not specify. (Panorama connection is also outgoing)

Hope this helps.

Regards,

Remo