topic Re: Pros and Cons of v-wire in General Topics

Pros and Cons of v-wire

svanarts — Fri, 10 Feb 2017 21:39:44 GMT

I'm setting up a PAN firewall between our company and our business partners who have direct connections to our LAN. My idea was to use v-wire but some of our other network administrators say it would be too difficult to troubleshoot. What are the pros and cons of using v-wire versus just setting up a L3 interface?

Re: Pros and Cons of v-wire

nextgenhappines — Sun, 12 Feb 2017 13:12:57 GMT

The pro, you can have L3-L4 firewall, App-ID visability, ACC, (Threat protection, URL Filtering) and LOGs instantly without making any "major" network changes (ie, re-ip all devices, cabling, etc) . All you need to do is to re-run couple of wires (depends on your network design).

Some other people consider vwire is more secured, because the attacker can't see the firewall mac address at all. It could be a curse or a blessing. I can't say. But it is another option to consider.

Just make sure you understand the spanning tree design consideraton,

https://live.paloaltonetworks.com/t5/Management-Articles/Spanning-Tree-Protocol-STP-packets-dropped-in-Vwire-mode/ta-p/56113

Cisco Link aggregation traffic,

https://live.paloaltonetworks.com/t5/Configuration-Articles/Cisco-Link-Aggregation-Traffic-Through-a-Palo-Alto-Networks/ta-p/61067

Re: Pros and Cons of v-wire

BPry — Mon, 13 Feb 2017 17:09:42 GMT

@svanarts; The advantage of v-wire is that there really isn't anything additional to troubleshoot. You'll still get all of the same alerts through the managmenet interface; you never actually see the firewall on the network, and you can still take actions to actually stop the connections.