topic PA Zones in General Topics

PA Zones

RC-BHF — Fri, 09 Oct 2015 07:02:30 GMT

I have several subnet routed through the PA for Internet Access. All the subnets are conencted via the same NIC.

I wanted to seperate the one of the subnet into a PA zone , but since it is connected to one NIC I cannot have two zones on the same NIC. Is this corerct ?

Re: PA Zones

cpainchaud — Fri, 09 Oct 2015 08:46:37 GMT

1 zone per logical interface so 1 NIC can have several subi-interfaces which are in different zones

Re: PA Zones

pankaku — Fri, 09 Oct 2015 12:40:34 GMT

I have created two subinterface of 1/3 now I can assign different zone to different subinterfaces. The physical interface will be part of native vlan and I have assigend tag 2 to 1/3.1 so it will be part of vlan 2 similarly 1/3.2 as part of vlan 3

Re: PA Zones

RC-BHF — Mon, 12 Oct 2015 09:02:57 GMT

Thank you both for the helpfull reply.

I would like to assign one of the subnets into a diffrent zones, would like to do it without having to set up VLANs etc, I have attached a diagram.

I would like the second subnet to be a diffrent zone in PA, but I am struggling to undertand I this can be done.

The Interface into the PA is just a Layer 3 with an IP. The routers Default GW is the PA.

Applogies, if this a basic question, I am PA newbie.

Re: PA Zones

cpainchaud — Mon, 12 Oct 2015 09:10:27 GMT

from your diagram you can't because the PA sees both network on same logical interfaces.

you may want to remove that router and put the PAN device instead

Re: PA Zones

reaper — Mon, 12 Oct 2015 09:32:54 GMT

You could use untagged subinterfaces,which allows the firewall to apply a different zone per configured subnet

This eliminates the need for VLAN tags:

How to Configure L3 Untagged Subinterfaces to Communicate within Different Zones

regards

Tom

Re: PA Zones

cpainchaud — Mon, 12 Oct 2015 09:38:22 GMT

in his case he has an intermediate router , can't work. In addition it's all but secure to have both in same vlan ...