About KaiGrunewald

Sounds Like a Plan ... ... View more

In that case I would setup static ip on the mgmt interface and connect that to your mgmt network and at the same time create a management profile which only allows ssh/https/ping and connect that to a dedicated dataplane interface (like the last one or so) along with setup a dhcp server profile which you attach to the same dedicated dataplane interface. Dont forget to put this in its own VSYS if possible (along with its own VROUTER). This way your technician(s) can use either the dedicated mgmt-network OR connect directly to the PA device on the last dataplane interface (or which one you choose) by DHCP. Another method is to simply use static ip on the mgmt dataplane interface (along with VSYS and VROUTER) - this way your technician(s) knows that last interface always uses 10.0.0.1/24 (or whatever) and is for mgmt being directly attached when you have physical access to the box. The point of VSYS/VROUTER is to isolate it as much as possible from the other dataplane interfaces. ... View more