Accessing UID-Agent or AD When Your Management Interface is OOB

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.
Community Team Member




Special shoutout to Cyber Elite @reaper for his contribution to this blog! 


It's considered best practice to create an Out Of Band (OOB) network for the management interfaces of your security appliances and services, so that they cannot be compromised.


But an OOB network can create interesting challenges. Your appliances may need to access resources that are not available on the secured network. One example is Palo Alto Networks' integrated User Identification mechanisms, where either the firewall reads security audit logs on an Active Directory server, or the server gets an agent software installed that does the reading and sends the output back to the firewall. If the AD server is not connected to the secured network, a different route needs to be taken to get that information on the firewall.


For this particular use case, a service route can be configured that redirects connections originating from the management plane, via the backplane, to the dataplane. This will force the outgoing connection to egress from a normal network interface without exposing the management interface (pretty cool, huh?).


To configure a service route:

  1. Navigate to the Device tab on your firewall
  2. Click the Setup section
  3. Go to 'Services'
  4. Find the 'Service Route Configuration' link
  5. Enable the 'Customize' radio button
  6. Scroll down to 'UID Agent' and
  7. Select the new source interface and IP address for these connections


Device > Setup > Services > Service Route ConfigurationDevice > Setup > Services > Service Route Configuration




NOTE: This will work for both the installed UID agent software and the clientless configuration on the firewall.


Additional information:


So, have you configured any service routes?


Feel free to share your questions, comments and ideas in the section below.


Thank you for taking time to read this blog.

Don't forget to hit the Like (thumbs up) button and to Subscribe to the LIVEcommunity Blog area.


Kiwi out!

Register or Sign-in
Top Liked Authors