topic Re: Layer 2 Interfaces with No VLANs in Next-Generation Firewall Discussions

Layer 2 Interfaces with No VLANs

MageshKumarG — Wed, 01 May 2024 05:50:17 GMT

Hi,

I have created following topology in PA (10.1.0) virtual lab to test "Layer 2 Interfaces with No VLANs".

Topology :- PC-1 --> L2 INT(None) - PA-VM - L2 INT(None) --> PC-2

I'm unable to establish connectivity between PC-1 and PC-2. Both Ingress/Egress interface configured under same zone.

Also, while capturing the traffic I observed, the ARP request (Broadcast) sent by the PC-1 was dropped on PA. But as per the PA admin guide, it should broadcasts the unknown frame to all of its Layer 2 interfaces. why firewall not forwarding unknown/broadcast frames to other L2 interfaces?

Re: Layer 2 Interfaces with No VLANs

TomYoung — Wed, 01 May 2024 17:20:32 GMT

Hi @MageshKumarG ,

Wow! This is the 1st time I have seen this -> https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-networking-admin/configure-interfaces/layer-2-interfaces/layer-2-interfaces-with-no-vlans#idc8766cd9-d6f9-4c08-96de-69bce440221c.

Is this an 11.0 feature?

I would go ahead and assign the interfaces to the same VLAN, and it should work fine.

Thanks,

Tom

Re: Layer 2 Interfaces with No VLANs

MageshKumarG — Thu, 02 May 2024 04:03:22 GMT

Hi @TomYoung

Yes. If we use same VLAN on both Ingress/Egress interface, we can able to establish connectivity between same network.

My queries regarding "NO VLAN" i.e. NONE feature in PA. What NONE means? I hope it act like Trunk port.

In layer 2 devices, the traffic between trunk ports is permitted. VLAN ID is not mandatory in Layer 2 devices. Is same applicable to PA as well?

This feature listed in old version also, I'm referring version 10.1 admin guide.

Thanks.

Magesh

Re: Layer 2 Interfaces with No VLANs

TomYoung — Thu, 02 May 2024 14:16:41 GMT

Hi @MageshKumarG ,

It is too bad the documentation is not more clear. That would be an easier way to configure a trunk. The way I know requires you to configure a L2 sub-interface for each VLAN that you want to trunk. The nice thing about that method is that you can attach different zones to each sub-interface and have different policies for each VLAN.

Thanks,

Tom

Re: Layer 2 Interfaces with No VLANs

MageshKumarG — Wed, 15 May 2024 08:51:23 GMT

Hi @TomYoung

Yes. You are right. We can configure both ingress and egress interface in same VLAN ports and make connectivity between them.

I just want to test "L2 NONE" option in PA. I'm new to PA, so I taught, it acts same like trunk ports, may be its processing the traffic differently.

Thanks.

Magesh