topic Connect same VLAN to multiple V-SYS in General Topics

Connect same VLAN to multiple V-SYS

cloudmansamjay02 — Mon, 20 Mar 2023 04:58:59 GMT

Hi All,

We have a PA-5220 firewall cluster which has running multiple V-SYS itself. The firewall is connected to the up stream router thru a port channel. On the up-stream router VLAN 10 is allocated to the WAN-IP range. I need to extend that VLAN 10 to the V-SYS A and V-SYS B so I can can assign the respective public IP addresses to the different V-SYS systems. I tried to create sub-interfaced with the same VLAN tag and it was failed. Any one can propose a different approach to resolve this challenge ?

Please refer the attached Diagram for reference.

Re: Connect same VLAN to multiple V-SYS

kiwi — Tue, 21 Mar 2023 09:09:42 GMT

Hi @cloudmansamjay02 ,

I haven't tested this myself but found a discussion on the same topic:

https://live.paloaltonetworks.com/t5/general-topics/subinterfaces-with-same-vlan-tag/td-p/194570

Looks like the same VLAN-ID cannot exist in multiple subinterface under 1 physical interface. As per the last comment in that discussion the only workaround is to create the same VLAN-ID under multiple physical interfaces in order to assign to multiple vsys(es) to the same VLAN.

Hope this helps,

-Kiwi.

Re: Connect same VLAN to multiple V-SYS

cloudmansamjay02 — Thu, 23 Mar 2023 07:51:05 GMT

Hi,

Thank you for the swift response. I have already seen those topic and unfortunately it seems this is a limitation of the Paloalto platform. However, I am looking a workaround to address this issue if anyone can shed some lights.

Re: Connect same VLAN to multiple V-SYS

reaper — Thu, 23 Mar 2023 08:44:37 GMT

in such a case i'd set the switch to transmit that vlan ID natively (untagged) on the 2 ports used (you will need 2 physical interfaces for this) by the different vsys, that way both vsys are able to access that same network

hope this helps

Re: Connect same VLAN to multiple V-SYS

cloudmansamjay02 — Fri, 24 Mar 2023 04:49:28 GMT

Hi @reaper ,

Thank you very much for your in-put. But connecting it via another physical port is not option at this stage because, we do not have any free physical ports. So in that case, do u think I do not have any other alternatives ?

Re: Connect same VLAN to multiple V-SYS

reaper — Mon, 17 Apr 2023 11:02:31 GMT

that's going to be tricky and may depend on your switch's ability to have the same vlan native and tagged in the same trunk. if your switch is capable of doing that you could have one tagged and one untagged way into the vlan

the alternative is to configure a 'shared gateway' for the vlan, that will limit your functionality but it will allow multiple vsys access to the same vlan

Re: Connect same VLAN to multiple V-SYS

TomYoung — Mon, 17 Apr 2023 14:16:18 GMT

This is an old thread, but I will post my solution in case someone wanders here.

An interface can only be in 1 vsys. See step 3 -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/virtual-systems/configure-virtual-systems.

Each vsys will need a separate interface (or LAG for redundancy). Each interface can have as many subinterfaces as needed. In the case above with only 1 connection to the ISP, the customer needs to add a L2 switch to split the 1 connection to 2, very similar to an HA deployment.

Thanks,

Tom