topic Inter Vsys Routing in General Topics

Inter Vsys Routing

Kashif.Kamal — Sat, 11 Mar 2017 19:36:06 GMT

Hi,

I have to configure Inter vsys Routing where the traffic has to leave the firewall fromone vsys and enter into another Vsys. I am not able to find any documention on this scenario. I have already configured and tested the communication between vsys that will not leave the firewall but stuck on where traffic should leave the firewall.

If I have a Internet Vsys and a Datacenter Vsys I will take a cable from Inet Vsys interface and connect to DC Vsys interface for physicall connectivity now the question is about routing do I need to configure static routing on both the vsys and I believe it wont be towards the VR's of each other then how the routes would be configured towards the physical interfaces ? and both the VR's will see all the routes of each other ?

Thanks

Re: Inter Vsys Routing

TranceforLife — Sat, 11 Mar 2017 19:46:04 GMT

A very good article:

https://live.paloaltonetworks.com/t5/Featured-Articles/Tips-amp-Tricks-Inter-VSYS-routing/ta-p/69699

Re: Inter Vsys Routing

Kashif.Kamal — Sun, 12 Mar 2017 07:50:06 GMT

Hi,

Thanks for the informative link. My question is what is the benefit we get by Inter-VSYS Traffic That Must Leave the Firewall over Inter-VSYS Traffic That Remains Within the Firewall as far as I understood we will not have External zones between Vsys if we send the traffic out of firewall. Is there any other benefit to send the traffic out and back again

Re: Inter Vsys Routing

nextgenhappines — Sun, 12 Mar 2017 10:58:39 GMT

Hi,

You can use a shared gateway as the shared interface as shared_untrust and created external zone as untrust zone for each vsys and make sure the visability use configured between the shared gateway and all the vsys.

The interesting part will be traffic from vsys1 to vsys2 you will see two sessions

session 1: trust-vsys1 to untrust (vsys1)

session 2: untrust (vsys2) to trust vsys2

If the traffic desintation is not vsys1 or vsys2. the session will trust-vsys1 to shared_untrust.

The down side of doing it this way is any intervsys traffic will handle ONLY by the data plane processors. The intervsys traffic will not be able to offload by the offloader. The data plane processors have very limited throughtput. (Depend on your appliance). That can cause the DP CPU to go to 100% and stay as long as the intervsys sessions are alive.

Check this link out, https://live.paloaltonetworks.com/t5/Learning-Articles/Differences-between-packets-in-slow-path-fast-path-and-offloaded/ta-p/58845

You may want to have a deep dive with your SEs/Reseller too..