topic Re: Zone Creation in General Topics

Zone Creation

support_securalis — Thu, 04 Dec 2014 14:55:43 GMT

Hello Everyone,

I'm new on Palo Alto Configuration,

I would like to know if it's possible to configure 2 zones for the same physical network.

Use case:

Ethernet 1: Zone Servers: ip: 192.168.80.254/24

Ethernet 2: Zone internet 1 : 193.1.1.254/24

Ethernet 3: Zone internet 1 : 193.2.1.254/24

I would like to have another network 192.168.90.0/24 so that I can chose let's say

network 192.168.80.0/24 goes out on internet through Ethernet 2 and network 192.168.90.0/24 goes out on internet through Ethernet 3

How is that possible when I have only cable connected to the switch having both networks (192.168.80.0/24 and 192.168.90.0/24)

Regards

Re: Zone Creation

ssharma — Thu, 04 Dec 2014 16:00:45 GMT

Hi support.securalis ,

Yes that is possible. To address your 1st question, you can configure either secondary IP for .90 subnet on ethernet 1 or configure subinterfaces on Ethernet 1 for both .80 and .90 subnets.

To route the traffic you will need policy based forwarding, where you can say .90 subnet will take ethernet 3 when going out. And rest of your network will take regular route via Ethernet 2 (or vice versa).

Hope this helps. Thank you.

Re: Zone Creation

Dz3015 — Thu, 11 Dec 2014 15:22:12 GMT

Just to elaborate on what ssharma said:

If the 192.168.90.0/24 subnet is also coming from Ethernet 1 then yes, you will need to use PBF

However, if 192.168.90.0/24 is coming in from another interface, you can set up a virtual router for each path with the appropriate routes.

Re: Zone Creation

support_securalis — Fri, 12 Dec 2014 13:40:29 GMT

Thank you very much. I did it like configuring a second subnet on the same interface.

Re: Zone Creation

pulukas — Mon, 15 Dec 2014 02:51:36 GMT

Since you are looking to have each subnet use a specific ISP, you could simply put the ISP plus subnet into their own virtual router. This way no special configuration for PBF is needed.

Create two virtual routers

Put each ISP into one VR with a default route

Put the servers subnet into VR 1 and the user subnet into VR2

Re: Zone Creation

Dz3015 — Tue, 16 Dec 2014 17:38:47 GMT

Can you do that via a single interface?

Re: Zone Creation

pulukas — Sat, 20 Dec 2014 13:29:36 GMT

Sub interfaces are considered separate interfaces and can be placed into different virtual routers and zones.