topic 2 IP ranges in General Topics

2 IP ranges

jcostello — Tue, 27 Sep 2011 21:02:27 GMT

In the Juniper and Cisco firewall configurations it is possible to route a second IP range to a firewall without having to add a second default route. Is this possible under 4.0.5?

My client is wanting to be able to failover between two data centers with pairs of 5020s at each site and Panorama for configuration management.

If this is possible, is it also possible to set up end points for the VPNs and SSL VPNs on both ranges?

Thanks

James

Re: 2 IP ranges

kbrazil — Tue, 27 Sep 2011 21:36:02 GMT

Hi James,

Could you describe how the Juniper or Cisco is configured in more detail? I'm not sure I understand the configuration you are describing completely. If we understand the existing configuration we may be able to come up with something.

Thanks,

Kelly

Re: 2 IP ranges

jcostello — Tue, 27 Sep 2011 22:09:17 GMT

On the Cisco or Juniper configuration the ISP will forward/route the second range traffic to the IP of the firewall. You would then create static entries for NAT translation. It is also possible to set an interface IP address on the second range to connect VPN traffic.

The configuration suggestions I have seen on other questions involve having multiple gateways and using PBF. We would like to avoid PBF and multiple default routes so that we can float the SSL VPN and VPN traffic between sites.

Re: 2 IP ranges

kbrazil — Tue, 27 Sep 2011 22:17:35 GMT

Hi James,

So far it doesn't sound like anything the Palo Alto Firewall can't do. You can have secondary IPs, Loopbacks, static NATs, etc available to you. The routing functions are not too different in that respect from the other vendors. The PBF design is to allow outbound failover without routing protocol.

Cheers,

Kelly