topic issues with traffic passing through vWire in Next-Generation Firewall Discussions

issues with traffic passing through vWire

D.Sine — Mon, 03 Feb 2025 19:45:46 GMT

hi guys, i'm trying to set up a new Palo Alto firewall, a PA 440, for a customer. But they want minimal impact on their network and don't want to change anything, so i proposed setting up a vWire so they change nothing and can benefit from the inspection features of the new Palo box.

pretty much here's how it kinda looks like:

ISP Router --> Core Switch --> PA 440 --> Existing Firewall --> LAN

Following the official documentation, i set up 2 vWire interfaces with a zone for each and i create a policy to allow everything, with just antivirus and vulnerabilty profile activated, the idea being i'll tighten it later

but there is no connectivity to the internet: pings are not responsive and websites don't load. in the monitor logs, i see all requests are allowed, but they all say application is incomplete

what have i missed ?

Re: issues with traffic passing through vWire

OtakarKlier — Tue, 04 Feb 2025 20:02:50 GMT

Hello,

Most of the time when I see the application as 'unknown' its a connectivity issue. Also I would suggest putting the PAN between the existing firewall and the clients so you can see that traffic and build policies on it. Also make sure your policie(s) allow traffic in both directions.

Re: issues with traffic passing through vWire

D.Sine — Tue, 25 Feb 2025 13:24:16 GMT

just to give a quick update: in the end i added the VLAN tags to the vWire, and also had to create a Zone Protection Profile and set TCP Non-SYN Packet rejection to No. apparently it is an asymetric routing issue, see this kb for details: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSHCA0