>
    Configure a Service Route
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. Set Up Firewalls
    4. Device Setup
    5. Configure a Service Route
    Download PDF
    Next-Generation Firewall

    Configure a Service Route

    Table of Contents

    Configure a Service Route

    Configure a service route to allow the firewall to access external services.
    Contact your account team to enable Cloud Management for NGFWs using Strata Cloud Manager.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Strata Cloud Manager)
    • VM-Series, funded with Software NGFW Credits
    • AIOps for NGFW Premium license (use the Strata Cloud Manager app)
    By default, the firewall uses the management (MGT) interface to access external services such as DNS servers, external authentication servers, and Palo Alto Networks services such as software, URL, and license updates. An alternative to using the MGT interface is to configure a data port (a regular interface) to access these services. The path from the interface to the service on a server is known as a service route. The service packets exit the firewall on the port assigned for the external service and the server sends its response to the configured source interface and source IP address.
    For firewalls in a high availability (HA) configuration, the service route configuration is synchronized across the HA peers. For firewalls in an active/passive HA configuration, the service route you configured sees activity only on the active HA peer while the passive HA peer sees no activity if you configure an Ethernet interface as the Source Interface. However, if you configure the MGT interface as the service route Source Interface, activity occurs on both the active and passive HA peers.
    1. Log in to Strata Cloud Manager.
    2. Configure an interface to use for the service route.
    3. Select ManageConfigurationNGFW and Prisma AccessDevice SettingsDevice SetupManagement and select the Configuration Scope where you want to create the service route.
      You can select a folder or firewall from your Folders or select Snippets to configure the service route in a snippet.
    4. Config Service Route.
      If you have already configured service routes for some services, the Service Route Settings is labeled as Customized.
    5. Configure a service route.
      1. Select Customize.
        If you have already configured service routes, you can quickly configure all services to Use Management Interface for all to restore the default service routes for all services.
      2. Configure the service route for a service.
        • For a Predefined Service
          1. Select IPv4 and click the Service name for which you want to customize the service route.
          2. Select the Source Interface.
            Select Any to make all IP addresses on all interfaces available in the Source Address.
          3. Select the Source Address.
          4. Update.
        • For a Destination Service Route
          1. Select Destination and Add destination service route.
          2. Enter the Destination IPv4 address.
            In this case, if a packet arrives with a destination IP address that matches the configured Destination IP address, then the source IP address of the packet is sent to the Source Address configured in the next step.
          3. Select the Source Interface.
            Select Any to make all IP addresses on all interfaces available in the Source Address.
          4. Select the Source Address.
          5. Add.
          6. Save.
        If the configuration you're trying to save doesn't meet the criteria to pass the compliance check, you'll have the option to remediate the issue or override the warning and save the configuration anyway.
    6. Configure a custom service route that the firewall uses to query for User-ID information.
    7. Push Config to push your configuration changes.

    © 2024 Palo Alto Networks, Inc. All rights reserved.