topic Re: Can you have an interface with an SFP in receive only mode? in General Topics

Can you have an interface with an SFP in receive only mode?

Greg.Herbert — Thu, 16 May 2024 12:58:34 GMT

I have a scenario where we have a data diode transmitting over fiber to an interface on our PA220R (sfp 100fx). The difficulty is that the PA considers the interface as 'down' because of the nature of the data diode, the diode only sends to the PA over this fiber but will not receive any data from the PA by design. Does anyone know a way to hard code the interface/sfp to be 'up/on' and receive the traffic coming over the fiber?

Re: Can you have an interface with an SFP in receive only mode?

Brandon_Wertz — Thu, 16 May 2024 14:16:33 GMT

@Greg.Herbert wrote:

I have a scenario where we have a data diode transmitting over fiber to an interface on our PA220R (sfp 100fx). The difficulty is that the PA considers the interface as 'down' because of the nature of the data diode, the diode only sends to the PA over this fiber but will not receive any data from the PA by design. Does anyone know a way to hard code the interface/sfp to be 'up/on' and receive the traffic coming over the fiber?

I don't know of a way to force the interface up in Palo, but can you cheat it and connect the diode to a media converter and from the MC connect the PA220? Or place a switch in-between the diode and the 220 (with the diode and 220 on the same VLAN?)

Re: Can you have an interface with an SFP in receive only mode?

TomYoung — Thu, 16 May 2024 16:34:32 GMT

Hi @Greg.Herbert ,

Have you tried changing the Link State to up under the interface Advanced tab?

Thanks,

Tom

Re: Can you have an interface with an SFP in receive only mode?

Greg.Herbert — Thu, 16 May 2024 18:59:33 GMT

I've thought of this as a potential option, however I was hoping for a solution that doesn't require a change with the design authority if possible.

Re: Can you have an interface with an SFP in receive only mode?

Greg.Herbert — Thu, 16 May 2024 19:00:37 GMT

Yes, I have set that, however the PA keeps the interface as down and no traffic in recorded inbound.

Re: Can you have an interface with an SFP in receive only mode?

TomYoung — Thu, 16 May 2024 19:04:09 GMT

Setting the interface to up disables auto-negotiation. I thought that might be the issue. The interface is down because of no link, not lack of traffic. It looks like @Brandon_Wertz has the best solution.