The Panorama IP has been changed on the firewall, but the firewall still has a session to the original IP

[Wilbur]

Panorama is used for management and log collection. The IP address of Panorama has not changed. There is a firewall outside Panorama, which maps the 3978 port of the firewall's exit IP to Panorama. The managed firewall was originally configured with the private network IP of panorama. Now it is changed to the mapped public network IP. After the change, the original private network IP is still reachable. The management traffic of the firewall will pass through its own data layer. It can be seen from the firewall session that there is still a session to the original private IP address. Is this normal? Is there an official statement?

[laurence64]

Hi 

There are a couple of things here to check, one would be the configurations that include the original IP of the Panorama, such as log collector groups and so on, as the traffic for the Panorama communication is running through the data plane of the firewall I would look at the session browser to see if these are just old sessions that are still active, if they are you could try clearing them, you can do this from the session browser by clicking the X at the end of the session entry, you could also try restarting the management server of the firewall using the "debug software restart process management-server"

From the command line, you will lose the management connectivity to the firewall momentarily as it restarts but it should not affect data plane traffic in any way.

Hope this helps.

[nikoolayy1]

This seems like a bug that causes crashes or/and memory leaks and till it is fixed maybe you can run a script using tools like Ansible or XSOAR to periodically restart the process or the managment plane:

https://paloaltonetworks.github.io/pan-os-ansible/modules/panos_op_module.html

https://xsoar.pan.dev/docs/reference/integrations/panorama

[laurence64]

Automating those tasks is really elegant solution, XSOAR would make it really easy to, I wonder is there a playbook already for this? I will check when I have chance.

[Wilbur]

Hello All,

After I configured the public IP to Panorama's management interface, this problem was solved. Thank you for your support.

Regards

Wilbur