topic Re: Connecting L3 Port of Palo Alto to the Switch in General Topics

Connecting L3 Port of Palo Alto to the Switch

harmander — Wed, 31 Aug 2016 05:02:55 GMT

Hi there,

On Palo Alto I have configured L3 interface and assgined ip address to it. I would like to connect this interface to the switch. The switch has an SVI configured with the port in the same vlan as the SVI. Can I connect the Palo Alto interface to the switch port which is configured with a vlan or do I need to make the switch port as a routing port.

Thanks Guys

Re: Connecting L3 Port of Palo Alto to the Switch

reaper — Wed, 31 Aug 2016 08:49:38 GMT

Hi!

the firewall does not participate in STP so layer2 SVI bridging does not work, you can choose either

access port in the svi vlan and add routes that point to the SVI
routed port
different design:

hope this helps

Re: Connecting L3 Port of Palo Alto to the Switch

darren_g — Wed, 31 Aug 2016 22:37:23 GMT

@harmander wrote:
Hi there,

On Palo Alto I have configured L3 interface and assgined ip address to it. I would like to connect this interface to the switch. The switch has an SVI configured with the port in the same vlan as the SVI. Can I connect the Palo Alto interface to the switch port which is configured with a vlan or do I need to make the switch port as a routing port.

Thanks Guys

I do exactly that on my core switches to allow for the HA configuration.

Firewall is configured with an L3 interface, switch cluster is configured with an RVI (Juniper speak, not Cisco), each port for the firewall is a simple access port in the associated VLAN for the RVI. I just post routes to the RVI address.

That way, it doesn't matter which firewall is active at the time - both are connected into the same routes, and an ARP flood when HA failover occurs means I rarely even lose a packet in the event of a HA event.