topic Re: Layer 2 network extension in Next-Generation Firewall Discussions

Layer 2 network extension

akilgolandaz — Mon, 15 Apr 2024 12:17:50 GMT

Is it possible to extend the layer 2 network over the layer 3 network to the other site using Palo Alto

Basically I am trying to extend the VLAN to other site. Not sure if this can be achieved with Palo Alto. Any suggestion are welcome

Re: Layer 2 network extension

reaper — Mon, 15 Apr 2024 15:21:42 GMT

just put the interfaces into layer2 mode and add them to a vlan (not a vlan interface, that's like a VRF)

add subinterfaces for each vlan tag you want to stretch if you're attaching trunk interfaces

below is a very basic example, in case you're not using trunk interfaces:

I have a small internet facing switch, and 2 internal switches. it's all a 'single vlan' so i'm not using tagged subinterfaces

Re: Layer 2 network extension

rmfalconer — Mon, 15 Apr 2024 16:49:06 GMT

Just because you can doesn't mean you should. Why do you want to extend L2 across sites?

Re: Layer 2 network extension

akilgolandaz — Tue, 16 Apr 2024 06:48:30 GMT

Thank you for your response Reaper,

you are using the vlan on the same site but i want to extend this layer 2 vlan to the far end site using layer 3 network. Which seems to be difficult using Palo Alto

Re: Layer 2 network extension

akilgolandaz — Tue, 16 Apr 2024 06:49:34 GMT

That is the exceptional requirement for the user, hence wanted to check if it is feasible on Palo Alto

Re: Layer 2 network extension

akilgolandaz — Tue, 16 Apr 2024 07:07:19 GMT

Please find the attached for the better understanding of the requirement

Re: Layer 2 network extension

reaper — Tue, 16 Apr 2024 07:24:47 GMT

ah you want to stretch L2 across sites over a VPN connection. This is not a function offered by Palo Alto (or any firewall AFAIK), this would be something that is handled by network equipment or a Telco/ISP/WAN operator