topic VWire configuration testing in General Topics

VWire configuration testing

Mic — Fri, 02 Aug 2013 16:39:04 GMT

Hi,

At a recent PA training, the instructor mentioned a testing method for testing the configuration of VWire objects and the traffic flow, as configured in your Security Policy. The goal of this method is the ability to do testing in a lab environment vs. testing your traffic flow after you've put the device into production.

With your device in a lab environment and the VWire objects and interfaces configured, you connect ethernet to two ports you're testing. To that you connect two switches and one laptop to either swtich (two laptops total). You then set each laptop's gateway to the other laptop and see if you can connect.

By reaching the laptop over the other port, you're able to determine that your security policy between those two zones is configured as needed. And you repeat this for your other ports/zones to test inter-zone traffic.

Is anyone able to confirm this method or offer a suggestion on testing VWires object / zone / Security Policy configurations prior to deploying the PA into production? Thanks

Re: VWire configuration testing

kprakash — Fri, 02 Aug 2013 17:25:47 GMT

Thats an easy test to begin with. But you will only be able to test minimal traffic between the 2 laptops. The real load test would be when you pass pre-production traffic, with the PANFW, inline with the netwok ( before you replace your existing firewall with the PANFW ), without disturbing your existing layer 3 setup.

------------ internal networl---------- inside vwire inter-------------PANW----------outside vwire interface -------------router/firewall---------internet cloud

The PANFW will act as an IPS, process the traffic, matching for the applications and looking for threats.

BR,

karthik

Re: VWire configuration testing

Mic — Fri, 02 Aug 2013 17:32:42 GMT

Right, it's a very basic initial test with the goal being sure that your Security Policy allows all your inter-zone traffic. I'm hoping to get details from others that have tested VWire configurations in a lab environment, without having to generate traffic from different networks to test the Source<->Destination allows in the Security Policy.