Configure your device to route all management traffic (such as updates, logging, and administrative access) through the dedicated management interface instead of through your regular data interfaces. This keeps your management traffic separate from your network traffic.

Allow you to manually specify which types of management traffic use the management interface and which use your data interfaces. This gives you granular control over how different services communicate.

Static—Manually enter the IPv4 or IPv6 address (or both) and one or more default gateways, which are described further down in this table.

DHCP Client—Configures the MGT interface as a DHCP client so that the NGFW can send DHCP Discover or Request messages to find a DHCP server. The server responds by providing an IP address (IPv4), netmask (IPv4), and default gateway for the MGT interface. DHCP on the MGT interface is turned off by default for the VM-Series NGFW (except for the VM-Series NGFW in AWS and Azure). If you select DHCP Client, optionally select either or both of the following Client Options:

Send Hostname—Causes the MGT interface to send its hostname to the DHCP server as part of DHCP Option 12.

Send Client ID—Causes the MGT interface to send its client identifier as part of DHCP Option 61.

Assign an IP address to the interface.

Alternatively, you can assign the IP address of a loopback interface for NGFW management. By default, the IP address you enter is the source address for log forwarding.

HTTP uses plaintext, which isn't as secure as HTTPS. Therefore, Palo Alto Networks recommend you enable HTTPS instead of HTTP for management traffic on the interface.

Telnet uses plaintext, which isn't as secure as SSH. Therefore, Palo Alto Networks recommend you enable SSH instead of Telnet for management traffic on the interface.

Select the services you want to enable on the interface:

Choose the type of DNS service—Servers or DNS Proxy Object—for all DNS queries that the NGFW initiates in support of FQDN address objects, logging, and NGFW management. Options include:

Enable all communication with cloud-based services (such as software updates, telemetry, licensing servers, and remote management platforms) to be routed through the specified proxy server rather than connecting directly to the internet.

This is commonly required in corporate environments where direct internet access is restricted or where traffic inspection is mandatory for security compliance.

Download Only—Strata Cloud Manager will download the scheduled update. You must manually install the update on NGFWs and Log Collectors.

Download and Install—Strata Cloud Manager will download and automatically install the scheduled update.

Download and SCP—Strata Cloud Manager will download and transfer the content update package to the specified SCP server.

You can disable new apps in content updates only if you set the update Type to App or App and Threat and only if Action is set to Download and Install.

Select to disable applications in the update that are new relative to the last installed update. This protects against the latest threats while giving you the flexibility to enable the applications after preparing any policy updates. Then, to enable applications, log in to the NGFW, select DeviceDynamic Updates, click Apps in the Features column to display the new applications, and click Enable/Disable for each application you want to enable.

Enter the length of time (in minutes) for which the API key is valid (range is 0 to 525,600; default is 0). A value of 0 means that the API key never expires.

Expire All API Keys to invalidate all previously generated API keys. Use this option with caution because all existing keys are rendered useless and any operation where you are currently using those API keys will stop functioning.

HTTP uses plaintext, which is not as secure as HTTPS. Therefore, Palo Alto Networks recommend you enable HTTPS instead of HTTP for management traffic on the interface.

Telnet uses plaintext, which is not as secure as SSH. Therefore, Palo Alto Networks recommend you enable SSH instead of Telnet for management traffic on the interface.

Select the services you want to enable on the interface:

Select this option to enable the Message of the Day dialog to display when an administrator logs in to the web interface.

Enter the text (up to 3,200 characters) for the Message of the Day dialog.

Select a predefined icon to appear above the text in the Message of the Day dialog:

Select the SNMP version: V2c (default) or V3. Your selection controls the remaining fields that the dialog displays.

Enter the community string, which identifies an SNMP community of SNMP managers and monitored devices and also serves as a password to authenticate the community members to each other when they exchange SNMP get (statistics request) and trap messages. The string can have up to 127 characters, accepts all characters, and is case-sensitive.

Don’t use the default community string public. Because SNMP messages contain community strings in clear text, consider the security requirements of your network when defining community membership (administrator access).

SNMP user accounts provide authentication, privacy, and access control when NGFWs forward traps and SNMP managers get NGFW statistics. For each user, click Add and configure the following settings:

There are no restrictions on any password field character sets.

Commonly used words and phrases are not allowed as passwords, regardless of any combination of upper and lower case letters.

Specify the number of sequential duplicate characters permitted in a password (range is 3 to 16).

If you set the value to 3, the password can contain the same character in sequence three times but if the same character is used four or more times in sequence, the password is not permitted.

For example, if the value is set to 3, the system will accept the password test111 or 111test111, but not test1111, because the number 1 appears four times in sequence.

Specify the delay time (in seconds) between LLDP transmissions sent after a change is made in a TLV element.

The Transmit Delay must be less than the Transmit Interval. Range is 1 to 600; default is 2.

Forces your commit to fail if you do not add any tags or a description to the policy rule. If a policy rule already exists when you enable this option, the commit will fail if no tag or description are added the next time you edit the rule.

To fail the commit, you must Require tag on policies or Require description on policies.

Disable the App-ID Cloud Engine (ACE). ACE is enabled by default. To disable ACE, click the check box so that ACE is not enabled.

Define the device's response when security threats or policy violations are detected, such as blocking traffic, generating alerts, initiating quarantine procedures, or triggering automated remediation actions.