Layer 2 subinterfaces w/ Vlan interface for routing.....

VK9H13 — Mon, 26 Feb 2024 06:02:30 GMT

Say I want to connect this port to a switch downstream (trunk), with clients hanging off of switch on access ports and use vlan interfaces for routing. Switch is set to trunk allowing relevant vlans, the firewall interface is subinterfaced (layer2) with the respective tag and vlan assigned. This is not working. DHCP does not work at all. Can someone let me know if I am doing this correctly? I am having trouble getting this configured.

IE:

FW <trunk>Switch<access>Client

FW eth1/3 subinterfaced (eth1/3.600 - layer2) with tag and vlan. Vlan exists and is pointing to the vlan.600 interface.

When I have a physical interface assigned to a vlan, and a client directly plugged into the firewall port, DHCP/traffic works as expected.

I am accustomed to using layer3 subinterfaces, but this had me curious so I wanted to try it.

Re: Layer 2 subinterfaces w/ Vlan interface for routing.....

reaper — Mon, 26 Feb 2024 13:43:45 GMT

you need to have 2 "vlans" (it's a bit of unfortunate naming on Palo's side)

one is a layer2 vlan assigned to your subinterface that determines which interfaces belong to the same vlan and zone regardles of their tag (this is virtual layer 2 inside the chassis)

the other is the vlan interface, which is like a VRF (found in the interfaces > vlan tab). this is where you set a vlan interface up with an ip address so it can function as a default route, and this interface can be used to attach a DHCP server

topic Layer 2 subinterfaces w/ Vlan interface for routing..... in General Topics

Layer 2 subinterfaces w/ Vlan interface for routing.....

Re: Layer 2 subinterfaces w/ Vlan interface for routing.....