Your business continuity plan should include provisions for how to connect to critical devices, including firewalls and Panorama, during power outages and other events that prevent connecting to those devices over normal communication channels. The ability to connect to and manage devices on an out-of-band (OOB) network enables you to continue running your business when primary networks and power sources are down. Business continuity should be a core consideration of your network architecture.

The OOB network should never rely on a power source or network that could fail concurrently with the primary access network. How you architect OOB access to devices depends on your network architecture and your business considerations, so there is no “one size fits all” method of ensuring connectivity. However, there are guidelines that help you understand how to meet the goals of an OOB access network:

• Power considerations—Use a different power source (a separate circuit or a protected or battery-powered source) for the OOB network than you use for the regular access network. If you lose power to the regular network, you won’t lose power to the OOB network. Use power distribution unit (PDU) controls to remotely power devices on and off.
• Secure connection method—There are a number of ways to connect securely to an OOB network, for example, a terminal server device, a modem, or a serial console server. Examples of secure networks you can use for OOB access include LTE, dial-up, and broadband (completely separated from the normal broadband network) networks. The connection method you use depends on your business needs and network architecture. Regardless of the method you select, the connection must be secure, with strong encryption and authentication. See Administrative Access Best Practices for advice about how to secure management connections to the firewall and Panorama. You can connect into an OOB network remotely using SSH with strong authentication over an Ethernet LAN or you can dial in over a serial connection. The outbound connection will be serial.