topic Re: VPN & Portal on PA2020 running only Virtual Wires in General Topics

VPN & Portal on PA2020 running only Virtual Wires

RonaldGo — Tue, 15 Jan 2013 07:38:50 GMT

Our network has 3 separate connectivity to the internet and all of them are connected via virtual wire on our PA2020 and the only other network connection is the management port on a fixed internal IP...

total 7 ports used (3 pairs for the 3 virtual wires & 1 management).

is it possible to setup VPN & Captive portal on such a setup?

thanks!

Re: VPN & Portal on PA2020 running only Virtual Wires

mikand — Tue, 15 Jan 2013 08:04:53 GMT

I have a faint memory that PANOS 5.0 introduced the possibility to create L3-subinterfaces on vwire nic's so you then can use VPN & Captive Portal which needs a L3 interface to communicate with the client.

Re: VPN & Portal on PA2020 running only Virtual Wires

RonaldGo — Tue, 15 Jan 2013 08:13:55 GMT

thanks for this tip... i'll look into it and see where it leads...

Re: VPN & Portal on PA2020 running only Virtual Wires

mikand — Tue, 15 Jan 2013 08:27:49 GMT

I might be confused by this entry in the release notes:

Virtual Wire Subinterface – You can now create virtual wire subinterfaces in order to classify traffic into different zones and virtual systems. You can classify traffic according to the VLAN tag, or VLAN tag plus IP address (IP address, IP range, or subnet).

However I still think it should be possible to create a L3-subinterface on a VWire setup.

Because VWire is just like a regular switch and its settings are similar to the ones you can set for a switchport regarding "allowed vlan" and such. On a switch (if we take a cisco for example) you can setup loopback interface which will act as mgmt-interface (in the switch example). Which gives if dstip=loopback_ip then send to the system cpu else switch to the other physical interface - I think the same should be possible on a PA (and if not today then by a feature request unless there is some other magic involved when using VWire?).

Re: VPN & Portal on PA2020 running only Virtual Wires

cverite — Sat, 20 Apr 2013 08:55:39 GMT

I do the same test and I didn't see to add the response page for the portal captive on the subinterface Virtuel Wire.