Thanks for the good info. I ended up doing a hybrid of both for my situation. I set up the external interface as an alternate management interface and locked it down to our corportate public range. As for the VPN I left the configuration as template based and figure if I have any issues the day of, I will be able to override the template via the management external connection. Cheers!
... View more
Hello, I'm in the process of preparing two PA200s for our satelite sites. We are using Panorama to configure all of our firewalls and I'm trying to keep all my configs in the templates but am torn when it comes to the VPN configuration. My main concern right now is that we haven't received our IP's and routing info from the ISP and we need to ship out the firewalls today. When the firewalls arrive, the only way to get a connection back to Panorama is via the tunnel which isnt complete. So my question is should I make the entire tunnel configuration a local config on the 200's (ike, ipsec, tunnel) or should I only make the tunnel and ikegw local since they will need to be configured by our local resources at the remote site? What is the typical best practice for satelite vpn firewalls and panorama? I would like to try and standardize the tunnel configurations but this makes it difficult if configurations need to be local. How have others done this in the past? Thanks in advance! ~NH
... View more