Change the Manager Access Interface from Data to Management

You can manage the threat defense from either the dedicated Management interface, or from a data interface. If you want to change the manager access interface after you added the device to the management center, follow these steps to migrate from a data interface to the Management interface. To migrate the other direction, see Change the Manager Access Interface from Management to Data.

Initiating the manager access migration from data to Management causes the management center to apply a block on deployment to the threat defense. You must disable manager access on the data interface to remove the block.

See the following steps to disable manager access on a data interface, and also configure other required settings.

Before you begin

For high-availability pairs, unless stated otherwise, perform all steps only on the active unit. Once the configuration changes are deployed, the standby unit synchronizes configuration and other state information from the active unit.

Procedure

Step 1

Initiate the interface migration.

  1. On the Devices > Device Management page, click Edit (edit icon) for the device.

  2. Go to the Device > Management section, and click the link for Manager Access Interface.

    The Manager Access Interface field shows the current management interface as data. When you click the link, choose the new interface type, Management Interface, in the Manage device by drop-down list.

    Manager Access Interface
    Manager Access Interface

  3. Click Save.

    You must now complete the remaining steps in this procedure to enable manager access on the Management interface. The Management area now shows the Manager Access Interface: Management Interface, and Manager Access Details: Configuration.

    Manager Access
    Manager Access

    If you click Configuration, the Manager Access - Configuration Details dialog box opens. The Manager Access Mode shows a Deploy pending state.

Step 2

Disable manager access on the data interface(s) on the Devices > Device Management > Interfaces > Edit Physical Interface > Manager Access page.

See Configure Routed Mode Interfaces. This step removes the block on deployment.

Step 3

If you have not already done so, configure DNS settings for the data interface in a Platform Setting policy, and apply it to this device at Devices > Platform Settings > DNS.

See DNS. The management center deployment that disables manager access on the data interface will remove any local DNS configuration. If that DNS server is used in any security policy, such as an FQDN in an Access Rule, then you must re-apply the DNS configuration using the management center.

Step 4

Deploy configuration changes.

The management center will deploy the configuration changes over the current data interface.

Step 5

If necessary, re-cable the threat defense so it can reach the management center on the Management interface. For High Availability, perform this step on both units.

Step 6

At the threat defense CLI, configure the Management interface IP address and gateway using a static IP address or DHCP. For high availability, perform this step on both units.

When you originally configured the data interface for manager access, the Management gateway was set to data-interfaces, which forwarded management traffic over the backplane so it could be routed through the manager access data interface. You now need to set an IP address for the gateway on the management network.

Static IP address:

configure network {ipv4 | ipv6} manual ip_address netmask gateway_ip

DHCP:

configure network{ipv4 | ipv6} dhcp

Step 7

In the cloud-delivered Firewall Management Center, disable the management connection for the threat defense in the Devices > Device Management > Device > Management section, and then reenable the connection.

Step 8

Ensure the management connection is reestablished.

In the management center, check the management connection status on the Devices > Device Management > Device > Management > Status field or view notifications in the management center.

At the threat defense CLI, enter the sftunnel-status-brief command to view the management connection status.

If it takes more than 10 minutes to reestablish the connection, you should troubleshoot the connection. See Troubleshoot Management Connectivity on a Data Interface.