Luis Miguel Miguel

Firewall management

Discussion created by Luis Miguel Miguel on Oct 19, 2017
Latest reply on Oct 20, 2017 by Luis Miguel Miguel

I have inherited an environment with 3 firewall managers and several gateway clusters.

The gateway ip addresses defined for management (gateway objects’s ips) are cluster type/network objective.

I am planning to change this configuration and manage the gateway using “non monitored private” interfaces.

 

To do that  I  also need to create a new ip for the firewall manager.  So basically I will create a new network/vlan for firewall management where I will attach firewall gateways and firewall managers.

 

The current firewall manager have two interfaces and it reaches firewall gateways through both interfaces, so it presents different ips to different gateways.

We don’t have implied rules for the management traffic. Global propierties -> Firewall -> Accept control connections is disabled. Therefore we have explicit rules with the firewall manager and firewall gateways objects.

We also have implied rules for “Outgoing packets generated from the firewall gateway”.

 

I have checked the logs to analyze the firewall manager and I have seen that the two of the firewall manager ips match the explicit rule for traffic management. I am wondering why. Is it expected?

 

I would have expected to see matches only from the ip configured in the firewall manager object.

The firewall manager license is linked to the old firewall manager ip. Does it need the firewall management ip to be the same as the licensed ip? Or is it only required to have the license ip configured as a network interface?

 

 

I was thinking of configuring new explicit rules for the new firewall gateways and new firewall managers. I guess that it won’t hurt anyway. But it looks like it wouldn’t be needed as we have a implicit rule for firewall gateway’s outgoing packets and it looks like the firewall manager object contains all the firewall manager ips.

 

In terms of the SIC, I don't need to be worried about it as SIC doesn't care about ips, correct?

 

Finally, I was wondering what the purpose of the firewall manager ip is.  I can think of two:

  • To be used in the implicit rules for traffic management
  • To sync with the other firewall manager in a HA firewall manager architecture.

Am I missing something?

Outcomes