topic Re: Palo FW setup site to site in General Topics

Palo FW setup site to site

Qui — Mon, 04 Apr 2022 00:57:38 GMT

Hi All,

We have a HA fw 3220 in our environment and our partner want to access some of our resources. They propose a PA-440 fw + small 12-port-Cisco 3560 in between the two sites by dark fiber.

Just wonder if you can setup FWs back to back instead of having a switch in between ie a extra point of failure?

is the Gateway going to be the switch or the FW440 behind it?

Any suggestion are much appreciated.

Thanks

Re: Palo FW setup site to site

S.Cantwell — Tue, 05 Apr 2022 20:08:33 GMT

I do not believe any of the PA4xx series including SFP ports, to connect up to fiber. A media converter would work in lieu of a switch, but it is still a Single Point of Failure....

Why not configure the FW to setup a site to site VPN to more securely connect.

Why not configure Global Protect and control where the users are allowed to client vpn into?

Why not configure clientless VPN and let the outside team use the FW to proxy internally inside of your network.

Lots o' questions.

Re: Palo FW setup site to site

Qui — Thu, 07 Apr 2022 00:30:02 GMT

Hi Steve,

Thank you for your advice.

We have already dark-fiber in place and I think it would be more secure/faster than other VPN option.

Thanks again.

Qui

Re: Palo FW setup site to site

OtakarKlier — Thu, 07 Apr 2022 16:59:05 GMT

Hello,

I prefer to put the layer 3 VLAN interface as a VLAN interface on the PAN. This way you have more granular control of the traffic using security policies and have the traffic inspected.

Regards,

Re: Palo FW setup site to site

JANARTHANAN1392 — Sat, 09 Apr 2022 06:18:15 GMT

This is a simple and doesn't required to add PA 440+ Just 12port switch is enough.

Re: Palo FW setup site to site

Qui — Mon, 11 Apr 2022 00:06:02 GMT

HI JANARTHANAN,

Does it mean we need to have ACL on the 12 port switch ?

Because we only want them to access certain resources.

Thanks

Q

Re: Palo FW setup site to site

JANARTHANAN1392 — Mon, 11 Apr 2022 02:54:29 GMT

You can control the access in your end Firewall 3220.

Your partner network have dedicated fiber line till your network right. Then just create a VLAN in PA3220 assign it to security zone for ACL rule creation and extend it to your partner network switch.