Next-Generation Firewall
Configure a Service Route
Table of Contents
Configure a Service Route
Configure a service route to allow the firewall to access external
services.
Contact your account team to enable Cloud Management for NGFWs using
Strata Cloud Manager.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
One of these:
|
By default, the firewall uses the management (MGT) interface to access external
services such as DNS servers, external authentication servers, and Palo Alto
Networks services such as software, URL, and license updates. An alternative to
using the MGT interface is to configure a data port (a regular interface) to access
these services. The path from the interface to the service on a server is known as a
service route. The service packets exit the firewall on the port assigned for the
external service and the server sends its response to the configured source
interface and source IP address.
For firewalls in a high availability (HA) configuration, the service route
configuration is synchronized across the HA peers. For firewalls in an
active/passive HA configuration, the service route you configured sees activity only
on the active HA peer while the
passive HA peer sees no activity if you configure
an Ethernet interface as the Source Interface. However, if
you configure the MGT interface as the service route Source
Interface, activity occurs on both the
active and passive HA
peers.
- Log in to Strata Cloud Manager.
- Configure an interface to use for the service route.
- (PA-5200 Series Firewalls only) Configure the Auxiliary Interface Settings
- Select and select the Configuration Scope where you want to create the service route.You can select a folder or firewall from your Folders or select Snippets to configure the service route in a snippet.
- Config Service Route.If you have already configured service routes for some services, the Service Route Settings is labeled as Customized.
- Configure a service route.
- Select Customize.If you have already configured service routes, you can quickly configure all services to Use Management Interface for all to restore the default service routes for all services.
- Configure the service route for a service.
- For a Predefined Service
- Select IPv4 and click the Service name for which you want to customize the service route.
- Select the Source Interface.Select Any to make all IP addresses on all interfaces available in the Source Address.
- Select the Source Address.
- Update.
- For a Destination Service Route
- Select Destination and Add destination service route.
- Enter the Destination IPv4 address.In this case, if a packet arrives with a destination IP address that matches the configured Destination IP address, then the source IP address of the packet is sent to the Source Address configured in the next step.
- Select the Source Interface.Select Any to make all IP addresses on all interfaces available in the Source Address.
- Select the Source Address.
- Add.
- Save.
If the configuration you're trying to save doesn't meet the criteria to pass the compliance check, you'll have the option to remediate the issue or override the warning and save the configuration anyway.
- Configure a custom service route that the firewall uses to query for User-ID information.
- Push Config to push your configuration changes.
