topic Proxy ARP for Private VLAN? in Next-Generation Firewall Discussions

Proxy ARP for Private VLAN?

ALSdburns — Mon, 13 Mar 2023 21:35:17 GMT

Is there a 'proxy arp' interface command (or equivalent) to allow l3 communication between isolated devices on private VLANs?

I am looking to move our DMZ to a private VLAN. I would like all ports to be isolated, but allow some communication between certain machines. This is where I would generally set up 'proxy arp' on the router to allow l3 communication, but I do not see this option on PA. Is there a way to set this up?

Re: Proxy ARP for Private VLAN?

nikoolayy1 — Wed, 22 Mar 2023 14:05:41 GMT

This is usually done with NAT on Palo Alto:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm4GCAS

Also you can test the U-Turn NAT option:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEiCAK

Re: Proxy ARP for Private VLAN?

ALSdburns — Fri, 14 Apr 2023 17:53:03 GMT

Thank you for the input, and sorry for the super late reply, I somehow missed this notification.

I am not quite clear how those articles relate to my issue. In this scenario would I create a NAT policy that applies to the PVLAN so that the PA responds to all ARPs but not actually set a translation address?