topic Re: Can you create two virtual firewalls inside one physical PA-200? in General Topics

Can you create two virtual firewalls inside one physical PA-200?

MikeJamrog — Fri, 02 Oct 2015 19:48:50 GMT

I am wondering if you can create two virtual firewalls inside one physical PA-200 box?

If this is possible I would like two physical ports to be allocated to each virtual firewall. One virtual firewall and its set of ports will be for a production network and the other virtual firewall and ports will be used for a visitor network. I am trying to figure out a solution to avoid having to use two separate PA-200 boxes. I have one solution which is the visitor traffic flow over the same vpn interface as the production traffic, which I want to avoid.

Re: Can you create two virtual firewalls inside one physical PA-200?

pankaku — Fri, 02 Oct 2015 20:16:06 GMT

VSys are not supported on PA 200 and PA 500

Re: Can you create two virtual firewalls inside one physical PA-200?

glastra1 — Sun, 11 Oct 2015 04:42:25 GMT

As commented before VSYS are not supported, but you can create 2 virtual routers and assign two ports to each one. The networks will be segregated between the virtual routers (unless you create inter-VR routes). The only downside is that the security policies will be in the same rulebase but you can create two tags: production and visitors and assign the corresponding one to each policy to help you with the management.

https://live.paloaltonetworks.com/t5/Configuration-Articles/Understanding-Virtual-Router-and-Virtual-Systems/ta-p/64901

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Tag-and-Filter-Security-Policy-Rules/ta-p/53937

https://live.paloaltonetworks.com/t5/Community-Blog/Organize-Your-Rulebase-with-Color-Coded-Tags/ba-p/51896

Regards,

Gerardo