PA-VM on ESXi - L2 Topology Design Questions

bkeifer — Mon, 13 Jul 2015 19:04:12 GMT

I'm looking to deploy a pair of PA-VM 200s running 7.x on a vSphere 5.5 cluster and would like a sanity check on the design.

My client's network currently has one large VLAN that houses most of their servers. For the sake of this example, we'll say it's VLAN 8. There are servers on this network with varying degrees of importance, but among them are things like domain controllers and file servers. To increase security, we're looking to deploy an active/passive HA pair of PA-VM 200s running 7.x (for the real HA capabilities) in L2 mode so that we can move some of the more important VMs behind them and not have to renumber. I'm assuming that the ethernet1/2 interfaces will also need to be assigned to VLAN 8 on the PA-VMs so that it knows to bridge the traffic.

- Does the protected port group on the vSphere DSwitch have to be VLAN ID 8 as well, or can I just leave it as VLAN type "None"?

- Is there anything extra I need to do to ensure that the HA pair will never accidentally create a loop between the two segments of the same network?

- Are there any other considerations I need to know about in a deployment like this?

Thanks!

Re: PA-VM on ESXi - L2 Topology Design Questions

pulukas — Tue, 14 Jul 2015 12:10:57 GMT

- Does the protected port group on the vSphere DSwitch have to be VLAN ID 8 as well, or can I just leave it as VLAN type "None"?

Both sides will be none in your case. You only need to set tags if you have a Q tag port. In your design these are access ports so none is all you need to do.

- Is there anything extra I need to do to ensure that the HA pair will never accidentally create a loop between the two segments of the same network?

No, the passive device keeps the traffic interfaces up but never passing traffic. The PA will not participate in STP at all so all you need to do is make sure the switching system never puts the active device into a blocking port.

- Are there any other considerations I need to know about in a deployment like this?

I have not used the VMs for HA but I assume you still need the HA ports connected to communicate state tables and the like. I don't see that in your setup here.

your may find the example for layer 2 HA in the Design guide helpful starting on page 80

Designing Networks with Palo Alto Networks Firewalls

topic Re: PA-VM on ESXi - L2 Topology Design Questions in General Topics

PA-VM on ESXi - L2 Topology Design Questions

Re: PA-VM on ESXi - L2 Topology Design Questions