topic Re: Overlapping Vwires - is it possible? in General Topics

Overlapping Vwires - is it possible?

cowboy71 — Fri, 16 Aug 2013 03:07:17 GMT

Got a situation where the deployment requires (in very basic terms):

VWIRE1 = Ethernet1/1 and Ethernet1/2

VWIRE2 = Ethernet1/2 and Ethernet1/3

Now this is not exactly 'standard' practice - but is it possible?

Re: Overlapping Vwires - is it possible?

kprakash — Fri, 16 Aug 2013 03:24:33 GMT

This is not supported.

BR,

Karthik

Re: Overlapping Vwires - is it possible?

sraghunandan — Fri, 16 Aug 2013 03:27:23 GMT

No this deployment is not possible as the basic concept behind vwire is if we receive packets on one interface transmit the packet out the interface which belongs to the same vwire .So in your scenario if packet is received on eth1/2 it won't know which interface to transmit it out . And also the fw won't let you select eth1/2 to be part of the 2nd vwire.

Re: Overlapping Vwires - is it possible?

HULK — Fri, 16 Aug 2013 03:27:28 GMT

No, it is not possible.

Reference guide https://live.paloaltonetworks.com/docs/DOC-1165

Thanks

Re: Overlapping Vwires - is it possible?

cowboy71 — Fri, 16 Aug 2013 03:37:58 GMT

Thanks so much for the feedback everyone!!

Re: Overlapping Vwires - is it possible?

mikand — Mon, 19 Aug 2013 07:49:19 GMT

Cant you do it with 2 different VSYS?

Like so:

--- VSYS1 ( VWIRE1 ( eth1/1 - eth1/2 ) ) --- VSYS2 ( VWIRE2 ( eth1/3 - eth1/4 ) ) ---

--- = physical cable

This way a cable goes into eth1/1, then another cable connects eth1/2 with eth1/3 and finally a third cable goes from eth1/4.

The drawback is of course that you will only have roughly half the number of concurrent sessions (because a single session will eat one entry in VSYS1 and a second entry in VSYS2).

Re: Overlapping Vwires - is it possible?

Retired Member — Mon, 19 Aug 2013 11:22:06 GMT

good point,

so what will be the difference if you use 1 vsys 3 cable and 2 vwires

eth1 eth2

eth3 eth4

connect eth2 and eth3 with a cable ?

Re: Overlapping Vwires - is it possible?

cowboy71 — Mon, 19 Aug 2013 21:49:32 GMT

Interesting thought that

Unfortunately dealing with a PA-500 - so no VSYS

Re: Overlapping Vwires - is it possible?

scantwell — Tue, 20 Aug 2013 12:43:09 GMT

Would this work if you used Vwire sub interfaces on the eth1/2 interface?

VWire1 = 1/1 and eth1/2.10

Vwire2 = eth1/2.20 to Eth1/3?

You would essentially add a VLAN tag to the 2.10 interface, send it down to your router, which would then send it back to the FW on a different vlan (routing between vlans, what a concept) then the router forwards the traffic to the 2.20 interface and to eth 1/3?

Thoughts on this from the community please?

Thanks

Re: Overlapping Vwires - is it possible?

cowboy71 — Wed, 21 Aug 2013 02:58:37 GMT

Just a little bit of feedback in resolution of the problem encountered. Basically the actual issue never ended up being overlapping Vwires at all.

The actual issue was that VLANs on the network were not passing through - because the default behaviour of vwires is to allow untagged traffic through, not tagged!

So by going into the configuration of each of the vwires, and setting it to allow all tags, it all worked beautifully