Change the manager access interface from management to data

Step 1

Initiate the interface migration.

1. On the Devices > Device Management page, click Edit () for the device. Click Device , and in the Management area, click the Manager Access Interface link.

   The Manager Access Interface field shows the current Management interface. When you click the link, choose the new interface type, Data Interface , in the Manage device by drop-down list.

   

2. Click OK and then Close .

   

   You must now complete the remaining steps in this procedure to enable manager access on the data interface. The Management area now shows Manager Access Interface: Data Interface , and Manager Access Details: Configuration .

   

   If you click Configuration , the Manager Access - Configuration Details dialog box opens. The Manager Access Mode shows a Deploy pending state.

Step 2

Enable manager access on the data interface (s) . Click Interfaces , click Edit () for the interface, and then click Manager Access .

Check Enable management access and click OK . By default, all networks are allowed, but you can limit access as long as the Cloud-Delivered Firewall Management Center address is allowed.

If the manager access interface uses a static IP address, you are reminded to configure routing for it.

Click Save on the Interfaces page. See Configure routed mode interfaces for more information about interface settings. You can enable manager access on one routed data interface , plus an optional secondary interface . Make sure these interfaces are fully configured with a name and IP address and that they are enabled.

If you use a secondary interface for redundancy, see Configure a redundant manager access data interface for additional required configuration.

Step 3

(Optional) If you use DHCP for the interface, enable the web type DDNS method on the DDNS page. Navigate to Devices > Device Management , and then click DDNS under the DHCP tab.

Step 4

Make sure the Firewall Threat Defense can route to the Cloud-Delivered Firewall Management Center through the data interface. Add a static route if necessary on the Static Route page. Navigate to Devices > Device Management and then click Static Route under the Routing tab.

Step 5

(Optional) Configure DNS in a Platform Settings policy: choose Devices > Platform Settings , and click DNS . Apply the policy to this device.

Step 6

(Optional) Enable SSH for the data interface in a Platform Settings policy, and apply it to this device at Devices > Device Management page. Click Edit () for the device and then click SSH Access .

Step 7

Deploy configuration changes.

You will see a validation error to confirm that you are changing the manager access interface. Check Ignore warnings and deploy again.

The Cloud-Delivered Firewall Management Center will deploy the configuration changes over the current Management interface. After the deployment, the data interface is now ready for use, but the original management connection to Management is still active.

Step 8

After deployment, perform these actions.

1. At the Firewall Threat Defense CLI (preferably from the console port), set the Management interface to use a static IP address and set the gateway to use the data interfaces. For high availability, perform this step on both units.

   
                           
                               configure network 
                               {
                               ipv4
                                | 
                               ipv6
                               } 
                               manual
                               ip_address netmask
                               data-interfaces
                            
                       

   • ip_address netmask —Although you do not plan to use the Management interface, you must set a static IP address, for example, a private address so that you can set the gateway to data-interfaces (see the next bullet). You cannot use DHCP because the default route, which must be data-interfaces , might be overwritten with one received from the DHCP server.

   • data-interfaces —This setting forwards management traffic over the backplane so it can be routed through the manager access data interface.

   We recommend that you use the console port instead of an SSH connection because when you change the Management interface network settings, your SSH session will be disconnected.

2. If necessary, re-cable the Firewall Threat Defense so it can reach the Cloud-Delivered Firewall Management Center on the data interface. For high availability, perform this step on both units.

3. In the Cloud-Delivered Firewall Management Center, disable the management connection for the Firewall Threat Defense in the Devices > Device Management page in the Management area under the Device tab, and then re-enable the connection.

Step 9

Ensure the management connection is reestablished.

In the Devices > Device Management page, click Manager Access Details: Configuration and then click Connection Status .

Alternatively, you can check at the Firewall Threat Defense CLI. Enter the sftunnel-status-brief command to view the management connection status.

This status indicates a successful connection for a data interface, showing the internal "tap_nlp" interface.

If it takes more than 10 minutes to reestablish the connection, you should troubleshoot the connection. See Troubleshoot Management Connectivity on a Data Interface .