topic Re: What is multi-vsys firewalls? in General Topics

What is multi-vsys firewalls?

tinhnho — Thu, 16 Mar 2023 03:02:52 GMT

Hi guys,

What is multi-vsys firewalls?

Why do we need multi-vsys firewalls?

What are cons and pros of using multi-vsys firewalls?

Could I get some cases that needs multi-vsys firewalls?

AS of now, my panorama has default vsys is vsys1 for the templates.

Thanks.

Re: What is multi-vsys firewalls?

kiwi — Thu, 16 Mar 2023 12:20:01 GMT

Hi @tinhnho ,

Please check out this multi vsys overview where you will find benefits and use cases:

Virtual Systems Overview

Kind regards,

-Kiwi.

Re: What is multi-vsys firewalls?

OtakarKlier — Thu, 16 Mar 2023 15:03:06 GMT

Hello,

Basically a way to logically segment the firewall for different uses/customers, etc.

Regards,

Re: What is multi-vsys firewalls?

UrikSilva — Thu, 16 Mar 2023 16:33:36 GMT

Hi @tinhnho

Normally vsys is used for Service Providers which needs to split (share) a big firewall appliance in small pieces attaching different interfaces, virtual routers, administrators, objects and so on.

Hope it was helpful.

Cheers,

Urik

Re: What is multi-vsys firewalls?

tinhnho — Thu, 16 Mar 2023 17:06:03 GMT

Thanks. If I have 2 firewalls, 5260 and 3220, for 2 customers (each customer has 2-5 staff) and they aren't busy at all, can I segment these 2 firewalls? What steps do we need to segment a firewall into a smaller logical firewall if we can?

Re: What is multi-vsys firewalls?

TomYoung — Thu, 16 Mar 2023 17:22:00 GMT

Hi @tinhnho ,

The PA-5260 supports 25 base virtual systems. The PA-3220 supports 1. https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-5260,pa-3220

First, you would need to purchase a vsys license for the PA-3220. Second, you would create a new virtual system. Third, you will create separate administrator roles for each virtual system. Then, your customers can configure their vsys just like a regular NGFW. Vsys1 can continue to be one of those virtual systems. I think you will need to assign interfaces to each vsys before the customers can use them. It has been a while. You could go with separate physical interfaces or use trunk ports and assign different sub-interfaces to each customer.

Thanks,

Tom

Re: What is multi-vsys firewalls?

Raido_Rattameister — Thu, 16 Mar 2023 17:23:57 GMT

If each customer manages their firewall themselves then yes you need to use vsys to avoid admin of one customer to see config of other customer.

If you manage it all and customers don't have access to firewall then vsys config adds complexity.

Re: What is multi-vsys firewalls?

tinhnho — Thu, 16 Mar 2023 18:45:26 GMT

Thanks guys, I'll be getting license for vsys