topic PVLAN in General Topics

PVLAN

Kenya5115 — Wed, 07 May 2025 06:14:32 GMT

Hello. I've been trying to use PVLAN with palo alto. I have two isolated host which are on the same subnet and wanted them to communicate through palo alto. I was able to manage with a switch using local proxy arp but from what I've searched palo alto doesn't have that feature.

I see the arp packets from host A going to palo alto but since the destination isn't palo alto and there isn't a proxy arp feature I believe palo alto drops them even before reaching the dataplane.

Has anyone successfully managed using PVLAN with pal alto?

Thank you for the help.

Re: PVLAN

BPry — Wed, 07 May 2025 21:46:14 GMT

@Kenya5115,

This functionality wouldn't be backed into PAN-OS at all. There's ways that you can get this to function by just segmenting everything via multiple gateways assigned to the same zone and setting and overriding the intrazone-default policy behavior with a dedicated rule or just by changing that policy form allow to deny, but there's not a magic way to get this to function and without a good handle on automation such a deployment could be a major inconvenience to the rest of your infrastructure team.

Re: PVLAN

TomYoung — Thu, 08 May 2025 01:36:56 GMT

Hi @Kenya5115 ,

You can have the NGFW inspect traffic between L2 hosts without having to route them via proxy ARP. You can connect them to L2 ports and add them to L2 zones. Then the security policy can be used to control traffic between the 2 hosts. You would create a VLAN interface to route traffic to different subnets. You could even migrate your current L3 interface to L2, but you would need to add a 2nd L2 connection for one of your hosts (either directly or though the switch on a new VLAN).

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRq

https://live.paloaltonetworks.com/t5/general-topics/security-policy-between-layer-2-zones/td-p/302930

Thanks,

Tom