topic Re: How to make access for another router thru PA-500 in General Topics

How to make access for another router thru PA-500

MyhreNDS — Mon, 30 Mar 2015 13:47:39 GMT

I need to setup router from vendor with official ip adress because it cannot use nat. It will support a service from Miele called "Miele Logic".

Without setting this directly on modem wiith swith I want to sett this on interface at PA.

I have not figured out what kind of design is best practis to use?

Re: How to make access for another router thru PA-500

pulukas — Mon, 30 Mar 2015 21:56:12 GMT

I'm not sure I follow the issue. But I think you are saying you need the Miele device to be on the public subnet but also behind the Palo Alto firewall.

For this application you could use a v-wire deployment. One side of the v-wire goes to the public untrust connection the other to the Miele device. Since v-wire has no layer 3 profile the device is both on the public subnet and also behind the firewall.

Re: How to make access for another router thru PA-500

MyhreNDS — Tue, 31 Mar 2015 06:26:00 GMT

I considered both virtual wire and Layer 2 but this requires two interfaces?

But have not been able to assign this to the Layer 3 untrusted interface.

I have configured a lot of Palo Alto but never with this settings.

The Palo Alto have been replaced from an SonicWALL firewall and this device was configured in transparent mode.

Re: How to make access for another router thru PA-500

pulukas — Tue, 31 Mar 2015 10:03:02 GMT

v-wire is separate from any layer 3 usage on the device. So the two interfaces in a v-wire act like an ethernet cable, one side connects to the untrusted device the other the protected device or network switch. Then anything that passes through the v-wire must have a rule.

This pair of interfaces will not participate in any layer 3 configuration on the Palo Alto. This is a "virtual wire" patch cable.

Re: How to make access for another router thru PA-500

MyhreNDS — Tue, 31 Mar 2015 10:13:12 GMT

For the internet connection I have only the untrusted interface for internet.

There is only one interface on modem. And I dont want to set up switch either.

Re: How to make access for another router thru PA-500

MyhreNDS — Tue, 07 Apr 2015 13:04:56 GMT

I give up

Convincing vendor to change IP in order to set up NAT.