Next-Generation Firewall
Device > Setup > Interfaces
Table of Contents
Expand All
|
Collapse All
Next-Generation Firewall Docs
-
-
-
-
-
-
-
- PAN-OS 12.1
- PAN-OS 11.2
- PAN-OS 11.1
- PAN-OS 11.0 (EoL)
- PAN-OS 10.2
- PAN-OS 10.1
- PAN-OS 10.0 (EoL)
- PAN-OS 9.1 (EoL)
- PAN-OS 9.0 (EoL)
- PAN-OS 8.1 (EoL)
-
- PAN-OS 12.1
- PAN-OS 11.2
- PAN-OS 11.1
- PAN-OS 10.2
- PAN-OS 10.1
Device > Setup > Interfaces
Use this page to configure connection settings, allowed
services, and administrative access for the management (MGT) interface
on all firewall models and for the auxiliary interfaces (AUX-1 and
AUX-2) on PA-5200 Series firewalls.
Palo Alto Networks recommends that you always specify the IP
address and netmask (for IPv4) or prefix length (for IPv6) and the
default gateway for every interface. If you omit any of these settings
for the MGT interface (such as the default gateway), you can access
the firewall only through the console port for future configuration
changes.
To configure the MGT interface on a M-Series appliance or the Panorama virtual appliance, see
Panorama > Setup >
Interfaces.
You can use a loopback interface
as an alternative to the MGT interface for firewall management (Network
> Interfaces > Loopback).
Item | Description |
---|---|
IPv4 or IPv6
(MGT interface only)
|
Select IPv4 or
IPv6.
|
Type (MGT interface only) | For IPv4, for Type, select one:
For
IPv6, Enable IPv6.
For
Type, select one:
|
Show DHCP Client Runtime Info
|
If you select DHCP Client, optionally click
Show DHCP Client Runtime Info to view the
dynamic IP interface status:
Optionally, you can Renew the DHCP lease for
the IP address assigned to the MGT interface. Otherwise,
Close the window.
|
Aux 1 / Aux 2 (PA-5200 Series
firewalls only) | Select any of the following options to enable an auxiliary interface. These interfaces provide 10
Gbps (SFP+) throughput for:
Enable HTTPS instead of HTTP for the web interface
and enable SSH instead of Telnet for the CLI.
|
IP Address (IPv4 Static) | If you chose IPv4 Static, assign an IPv4 address to the interface. Alternatively, you can assign
the IP address of a loopback interface for firewall management (see
Network > Interfaces > Loopback). By default, the IP
address you enter is the source address for log forwarding. |
Netmask (IPv4 Static) | If you assigned an IPv4 address to the interface,
you must also enter a network mask (for example, 255.255.255.0). |
Default Gateway (IPv4) | If you assigned an IPv4 address to the interface,
you must also assign an IPv4 address to the default gateway (the
gateway must be on the same subnet as the interface). |
IPv6 Address/Prefix Length (Static) | If you chose IPv6 Static, assign an IPv6 address to the interface. To indicate the netmask,
include the prefix length (for example, 2001:db8:300::1/64). |
IPv6 Address Type (Dynamic)
|
If you chose IPv6 Type to be Dynamic, the MGT
interface is an IPv6 SLAAC/DHCPv6 client. Select any combination of
DHCPv6 client options:
|
Default Gateway Type (IPv6)
|
If you assigned an IPv6 address to the interface, you must also
assign or receive a Default IPv6 Gateway
Address. Select the type of address assignment for
the default gateway:
If you choose Dynamic, you can Show Gateway Address
Info.
|
Speed | Configure a data rate and duplex option for the interface. The choices include 10 Mbps, 100 Mbps,
and 1 Gbps at full or half duplex. Use the default autonegotiate
setting to have the firewall determine the interface speed. This setting must match the port settings
on the neighboring network equipment. To ensure matching settings,
select auto-negotiate if the neighboring equipment supports that option. |
MTU | Enter the maximum transmission unit (MTU) in bytes for packets sent on this interface (range is
576 to 1,500; default is 1,500). |
Administrative Management Services |
|
Network Services | Select the services you want to enable on
the interface:
|
Permitted IP Addresses | Enter the IP addresses from which administrators
can access the firewall through the interface. An empty list (default)
specifies that access is available from any IP address. Don't leave the list blank; specify only the IP addresses of firewall administrators to prevent
unauthorized access. |