Panroma using public ip

[Dheeraj_singh]

Hi,

we are using multiple paloalto firewall .To manage centrally we are using panorma .But current configuration working through site to site vpn .

Can we established the connectivity through internet .It will help us even if the site to site vpn is disconnected.

Is it possible in Panorma ?

[nohash4u]

Hello, 

Yes, it is possible. There are a few ways to go about this from an architectural standpoint, but in general you need to ensure the following:

NGFW 

• Public IP of Panorama added under Device --> Setup --> Panorama Settings 
• Routing, NAT policy rule(s) and security policy rule(s) in place to allow communication to the public IP addressed used by Panorama. 
  • panorama app-id must be allowed (port 3978 by default). 
    
  • ssl app-id must be allowed 

Panorama 

• Panorama can be configured to use a public IP under Panorama --> Setup --> Interfaces --> Management 
• Traffic from each NGFW over the public internet needs to be permitted to Panorama in terms of functionality (NAT and routing) and security (security policy rules on the device that sits in front of Panorama).  Keep in mind that the public IPs of the NGFWs will be used, or the public IPs of routers which they connect to (again, depending on the setup). 

To reiterate: there may be numerous configurational steps that are required depending on your setup.  

Cheers