topic Re: Setting up portchannel from router to a pair of PA in General Topics

Setting up portchannel from router to a pair of PA

tinhnho — Thu, 25 Apr 2024 16:39:42 GMT

Hi Guys,

I have a pair of PA5220s and a Cisco router ASR1001. I want to set up a port channel on the router and then spread the interfaces between 2 PAs. Each interface on the PA is set for virtual wire. I have done port channels between Cisco routers and Nexus switches (vPC) many times, but I am not sure if the PA firewalls support this setup. If the PA supports this method, what do I need to set up on the PAs before plugging the interfaces of the Cisco router?

Please see my diagram. The firewalls are PA5220. The router is Cisco ASR1001.

Thanks.

Re: Setting up portchannel from router to a pair of PA

BPry — Thu, 25 Apr 2024 16:50:37 GMT

@tinhnho,

Is there a compelling reason to continue to utilize v-wire? Outside of initial PoC deployments I personally don't recommend keeping things deployed as a v-wire deployment.

Re: Setting up portchannel from router to a pair of PA

tinhnho — Thu, 25 Apr 2024 17:11:26 GMT

Hi BPry, The main reason was that I wanted to get visibility on the router's outside interfaces and be able to apply security profiles to these Vwire interfaces.

Re: Setting up portchannel from router to a pair of PA

tinhnho — Fri, 26 Apr 2024 20:30:11 GMT

I'd be curious, if you could elaborate more on why you don't recommend using vwire in this specific case except PoC.