topic Re: Internet and internal network sepration via virtual router in General Topics

Internet and internal network sepration via virtual router

gondolf — Tue, 24 Oct 2023 06:52:29 GMT

Hello,

I am new to Palo Alto. I have basic question.

Traditional setup I worked on my last project was as below,

VRF on cisco router for

- Internet -0 bgp

- Production - bgp

- DMZ - bgp

FW connects to all 3 VRF. Route between VRF is via FW. FW harden the access.

New project with PA and L2 switch for the same setup.

My idea is

create 3 x Virtual routers on FW ( Internet, Prod, DMZ)

and one policy for all of it.

However, what is the best way to route the traffic between VR with all the policy applied?

Re: Internet and internal network sepration via virtual router

OtakarKlier — Tue, 24 Oct 2023 20:20:11 GMT

Hello,

Is there a reason you want to use 3 virtual routers? Its the security policies that determine what traffic can go where. The Virtual router is just that, routing. I'm a fan on keeping it simple and having 3 can get complicated, etc.

Regards,

Re: Internet and internal network sepration via virtual router

gondolf — Tue, 24 Oct 2023 22:41:24 GMT

It is the cyber policy so I don't have much say in that one. 😞

Re: Internet and internal network sepration via virtual router

TomYoung — Wed, 25 Oct 2023 01:10:12 GMT

Hi @gondolf ,

The cyber policy requires 3 VRs on the NGFW or just the router? They are fine on the router. They are generally not needed on the NGFW. Some cyber security analysts think that separate routing tables provide an extra layer of security. The problem is that in order for it to work you have to route between the VRs, thus breaking the isolation.

Your router is different where an external device routes between VRFs. The NGFW does not require VRs to do so, only 3 separate zones and interfaces. VRs on the NGFW only increases the complexity without increasing the security.

@OtakarKlier is correct. KISS is not only a good design principle, but an architectural guideline for the Internet. https://datatracker.ietf.org/doc/html/rfc3439 There is a link in there that says 80% of outages are caused by people or process errors. Complex designs increase those opportunities.

If you HAVE to do it on the NGFW:

Create 3 different VRs.
Route between them with the next hop pointing to the VR and not an IP or interface.
The zones and security policy will remain the same whether you have VRs or not.

Thanks,

Tom

Re: Internet and internal network sepration via virtual router

gondolf — Wed, 08 Nov 2023 02:14:31 GMT

Thank you for the reply. I will put my recommendation to not separate them based on every one's reply. If not then I have solution now. I will find a lab online to do some labs.. do you know what is the best way to lab it.. either azure/aws/gcp with PAYG setup or EVN-NG lab .. need to find out the way to get the PA VM and licences for lab purpose.