topic Flat Network across PA-415 in Next-Generation Firewall Discussions

Flat Network across PA-415

jatin_2023 — Fri, 14 Jul 2023 20:27:47 GMT

Hello All,

I have spent ages and days and a few weeks setting up a PA-415 to work with a group of LAN ports into one network set into a VLAN configuration using the on-board DHCP server. One of the engineers in this forum assisted me extensively and helped me build the settings. I found this idea/solution in this community and the only way to group several LAN ports. I have a layer 3 on the WAN and layer 2 VLAN ID set to 4 ports on the LAN.

Today on the support website at palo alto, one of the recommendations outputted was configuration on layer 3 with no VLAN. So that got me thinking, can i configure a straight layer 3 networks on the wan side and a layer 3 network on the LAN side in a flat network with no need for vlans or segration so all ports 1 to 9 are all on the same subnet.

What do you think and is the simplest configuration?

From Jatin

#firewall

Re: Flat Network across PA-415

TomYoung — Mon, 17 Jul 2023 01:33:40 GMT

Hi @jatin_2023 ,

You cannot configured multiple L3 ports in the same subnet on the PA NGFW. This is a limitation by design on all routers. It can lead to multiple problems.

I have configured your original design, and it works fine.

Put port 1 in a L3 outside zone.
Create a VLAN for your inside interfaces.
Put ports 2-9 in a L2 inside zone and assign them to your VLAN.
Created a VLAN interface for the VLAN assigned to ports 2-9. Put the VLAN interface in a L3 inside zone.
Create a DHCP server attached to your L3 VLAN interface.
Use the L3 zones for your policies.

Thanks,

Tom

Re: Flat Network across PA-415

jatin_2023 — Mon, 24 Jul 2023 21:10:42 GMT

Sorry for the late reply Tom I have been on holiday most of last week and for a few days. Thank you Tom for the confirmation and the clear technical answer to my question. Most appreciated of your time.