The firewall uses the management (MGT) interface
by default to access external services, such as DNS servers, external
authentication servers, Palo Alto Networks services such as software,
URL updates, licenses and AutoFocus. An alternative to using the
MGT interface is to configure a data port (a regular interface)
to access these services. The path from the interface to the service
on a server is known as a
service route. The service
packets exit the firewall on the port assigned for the external
service and the server sends its response to the configured source
interface and source IP address.
When set to default
settings, certain services (such as External Dynamic Lists and URL
updates) use service route settings that are inherited by a parent
service (in this case, Palo Alto Networks Services) if it is explicitly
configured with an interface. If the defaults are not used, Palo
Alto Networks recommends configuring each of the services that you
use with an interface to ensure that the proper service route is used.
You
can configure service routes globally for the firewall (shown in
the following task) or
Customize
Service Routes for a Virtual System on a firewall enabled
for multiple virtual systems so that you have the flexibility to
use interfaces associated with a virtual system. Any virtual system
that does not have a service route configured for a particular service
inherits the interface and IP address that are set globally for
that service.
For firewalls in a
high availability (HA)
configuration, the service route configuration is synchronized across the HA peers.
For firewalls in an
active/passive high
availability (HA), the service route you configured to leverage an
external service or for log forwarding sees activity only on the
active HA peer while the
passive HA peer sees no activity if you configured
an Ethernet interface as the
Source Interface. For example,
you configure a service route with Ethernet 1/3 as the source interface to forward
logs to Cortex Data Lake. In this scenario, all logs are forwarded from the
active HA peer but no logs, including the system
and configuration logs, are forwarded from the
passive
HA peer. However, if you configure the MGT interface as the service route
Source Interface, activity occurs on both the
active and
passive HA
peers.
The following procedure enables you to change
the interface the firewall uses to send requests to external services.