topic Re: Is it possible that traffics go on each other sub-interfaces with same physical interface? in General Topics

Is it possible that traffics go on each other sub-interfaces with same physical interface?

KiCheon.Lee — Wed, 22 Oct 2014 10:14:39 GMT

Hello.

I want to make the following network-diagram. Is it possible?

A Cisco Nexus Paloalto

VRF-1 ----------------------> eth1/1.1 | 1.1.1.1 | VR : default | trust

tag 10 |

VRF-2 <--------------------- eth1/1.2 | 2.2.1.1 | VR : default | untrust

tag 20

1. Traffics go into sub-interface eth1/1.1 with tag 10.

2. FW process routing and policing.

3. Traffics go out from sub-interface eth1/1.2 with tag 20.

Two sub-interfaces are on same physical interface.

Thanks,

KC Lee

Re: Is it possible that traffics go on each other sub-interfaces with same physical interface?

Retired Member — Wed, 22 Oct 2014 10:22:35 GMT

Hi,

I think it is possible to work because sub-interfaces are different interface logically with tag number.

Thanks.

Regards,

Roh

Re: Is it possible that traffics go on each other sub-interfaces with same physical interface?

dreputi — Wed, 22 Oct 2014 13:31:22 GMT

Hello Cheon,

Yes this is possible. You have to make sure the following are in place:

-Layer3 subinterface eth1/1.1 configured for tag 10 , zone-x, ip-1.1.1.1/netmask

-Layer3 subinterface eth1/1.2 configured for tag 20 , zone-y, ip-2.2.1.1/netmask

-Security rules allowing traffic between zone x and y as required.

-optional-any other policies like nat etc.

Regards,

Dileep

Re: Is it possible that traffics go on each other sub-interfaces with same physical interface?

hshah — Wed, 22 Oct 2014 14:47:00 GMT

Hi Cheon,

Its very much possible, too many customer has this implementation. Good thing is you dont have to configure any special routing because both the interfaces on PANW are on same VR.

Refer following document on sub-interfaces

How to Create Tagged Sub-Interfaces

Regards,

Hardik Shah

Re: Is it possible that traffics go on each other sub-interfaces with same physical interface?

Retired Member — Wed, 22 Oct 2014 17:22:20 GMT

Also you can read Securing Inter VLAN Traffic for further information.

Re: Is it possible that traffics go on each other sub-interfaces with same physical interface?

KiCheon.Lee — Thu, 23 Oct 2014 01:59:39 GMT

Wow~.

Thank you very much~ Roh, dreputi, hshah, panos.

My worry is broken by you and get good energy.