https://live.paloaltonetworks.com/t5/general-topics/expressway-e-and-c-and-nat-and-vw/m-p/194048#M58101 <P><a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/59972">@simsim</a>,</P><P>This really depends on how you actually have the VWIRE setup. Without knowing what you config actually looks like it's kind of hard to say.&nbsp;</P><P>Couple different scenarios</P><P>1) You have security policies on the Palo Alto that actually limit source/destinaton and the applications allowed to pass through the vwire. In this situation yes, you'd likely need to create some additional policy.&nbsp;</P><P>2) You have the most basic vwire setup where the traffic is simply inspected but by default will allow everything to pass. In this situaiton you wouldn't need to create any additional policies.&nbsp;</P><P>&nbsp;</P><P>Really depends on your configuration, with the information given it's pretty much impossible to tell.&nbsp;</P> Fri, 05 Jan 2018 18:54:00 GMT BPry 2018-01-05T18:54:00Z https://live.paloaltonetworks.com/t5/general-topics/expressway-e-and-c-and-nat-and-vw/m-p/193900#M58081 <P>Hi,</P><P>&nbsp;</P><P>I have deployed Expressway (<SPAN>cisco ToIP)&nbsp;</SPAN>E and C&nbsp; as per the diagram below .PA is in VW mode .</P><P>Does it work&nbsp; without any changes in the PA ?&nbsp;</P><P>Or Is there any policy must be created ?&nbsp;</P><P>&nbsp;</P><P>Thanks&nbsp;<span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="PA.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/13137iC3A15762577BBBC5/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="PA.png" alt="PA.png" /></span></P> Thu, 04 Jan 2018 23:30:58 GMT https://live.paloaltonetworks.com/t5/general-topics/expressway-e-and-c-and-nat-and-vw/m-p/193900#M58081 simsim 2018-01-04T23:30:58Z https://live.paloaltonetworks.com/t5/general-topics/expressway-e-and-c-and-nat-and-vw/m-p/194048#M58101 <P><a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/59972">@simsim</a>,</P><P>This really depends on how you actually have the VWIRE setup. Without knowing what you config actually looks like it's kind of hard to say.&nbsp;</P><P>Couple different scenarios</P><P>1) You have security policies on the Palo Alto that actually limit source/destinaton and the applications allowed to pass through the vwire. In this situation yes, you'd likely need to create some additional policy.&nbsp;</P><P>2) You have the most basic vwire setup where the traffic is simply inspected but by default will allow everything to pass. In this situaiton you wouldn't need to create any additional policies.&nbsp;</P><P>&nbsp;</P><P>Really depends on your configuration, with the information given it's pretty much impossible to tell.&nbsp;</P> Fri, 05 Jan 2018 18:54:00 GMT https://live.paloaltonetworks.com/t5/general-topics/expressway-e-and-c-and-nat-and-vw/m-p/194048#M58101 BPry 2018-01-05T18:54:00Z