topic Re: Mult-Vsys Routing in General Topics

Mult-Vsys Routing

mrsold — Thu, 11 Jul 2013 12:24:50 GMT

Greetings,

Currently, we have a project underway to extend our internet redundancy. We have a pair of 5050's that have 3 Vsys at our main DC and a pair of 5050's which currently had two identical Vsys (the 3rd Vsys is irrelevant in this case and will only reside on that one pair). Here is the breakdown (some simplification happening):

Vsys 1 = Enterprise Traffic

Vsys 2 = Guest Traffic

Vsys 1

Ingress - E1

Egress - E2

Vsys 2

Ingress - E3

Egress - E4

In our redesign (due to some fiber limitations from our core to our FW) we'd like basically have the a single ingress point for both Vsys and then just some policy-based forwarding (as in, if you are coming from a specific source, you get punted to vsys2) - it's almost like a shared gateway but reversed. Since we obviously don't want to collapse the two vsys into one, we had the thought of doing an intra-chassis patch. So:

Patch E5 (assigned to vsys1) to E6 (assigned to vsys2) then, have a policy based forwarder that says anything coming from one of our guest networks is forwarded across that link thus making E6 the new ingress for vsys 2.

Does this method make sense? Any other thoughts on design?

Thanks!

Re: Mult-Vsys Routing

kprakash — Thu, 11 Jul 2013 13:00:26 GMT

Hi,

Seems logical, and should work. This would be one way of influencing the traffic to go out via the vsys-1 into ingress into vsys-2, because we cannot influence the traffic to go into a particular zone, if it is sourced from a subnet. Rather we can specify the egress interface for the traffic to go out from. So the PBGF rule should have the source address as the guest traffic, the destination address as any, and then the action forward and egress interface as eth1/5

BR,

Karthik

Re: Mult-Vsys Routing

mrsold — Thu, 11 Jul 2013 13:28:36 GMT

Thanks for the info. Is there any documentation on what the configuration from an interface / vrouter / security policy would look like? Anything documented?

Re: Mult-Vsys Routing

kprakash — Thu, 11 Jul 2013 13:32:34 GMT

Have you had a chance to look at the PBF tech note?

https://live.paloaltonetworks.com/docs/DOC-1562

Let me know if that helps.

BR,

Karthik

Re: Mult-Vsys Routing

kprakash — Thu, 11 Jul 2013 13:37:14 GMT

That was an older document. The below doc is more recent and appropriate

https://live.paloaltonetworks.com/docs/DOC-3220

BR,

Karthik