topic Re: Interconnect between layer 3 and layer 2 interface possible? in General Topics

Interconnect between layer 3 and layer 2 interface possible?

jeremylo — Wed, 11 Jul 2018 01:45:05 GMT

Is below configuration possible?

1. 1 layer3 interface act as gateway and DHCP

2. 1 layer2 interface interconnect to the layer3 interface above. The computer connected to this interface can reach the layer3 gateway and IP address receive from its DHCP

In short, 2 interfaces use the same gateway and DHCP.

Re: Interconnect between layer 3 and layer 2 interface possible?

BPry — Wed, 11 Jul 2018 02:29:08 GMT

@jeremylo,

To the best of my knowledge something like this isn't going to work. I imagine that you are trying to use a PA-200/220 for like a single small office device?

Re: Interconnect between layer 3 and layer 2 interface possible?

jeremylo — Wed, 11 Jul 2018 02:35:32 GMT

Hello BPry,

Correct. I'm now testing a PA-220.

Due to lack of network switch (in testing env). I want to use 2 interfaces connect to 2 computers. And these 2 computers need connect to the same gateway and receive IP address from the same DHCP.

Of course I've plenty of switch in production environment. I just want to see if this kind of configuration is possible on PA-220.

Re: Interconnect between layer 3 and layer 2 interface possible?

BPry — Wed, 11 Jul 2018 02:42:16 GMT

@jeremylo,

Ya I don't think what you are trying to do here is going to work at all. As soon as you attempt to configure the second interface you'll get validation errors due to the interfaces sitting on the same subnet.

Re: Interconnect between layer 3 and layer 2 interface possible?

jeremylo — Wed, 11 Jul 2018 02:51:08 GMT

BPry

So far my attempt either not work or even can't pass validation.

I thought PAN-OS 8 can emulate a virtual cable connect between layer3 (as router) and layer2 (as switch).

Maybe I go find a spare network switch instead.

Re: Interconnect between layer 3 and layer 2 interface possible?

OtakarKlier — Mon, 16 Jul 2018 21:47:04 GMT

Hello,

How about using a VLAN interface as the layer 3 and the physical as layer 2?

Just a thought.

Re: Interconnect between layer 3 and layer 2 interface possible?

jeremylo — Tue, 17 Jul 2018 02:36:46 GMT

Hello Otakar,

In pan-os 8. I can't select a layer 3 interface when create VLAN

Re: Interconnect between layer 3 and layer 2 interface possible?

cdcirexx — Fri, 07 Sep 2018 16:41:42 GMT

Hi guys,

I'm trying a similar setup, I'm installing a new pa820 replacing our old pa500, but currently the pa500 is acting as a router/gateway to clients and servers, but users are experiencing slow intervlan performance(the pa sub int seems to not run at 1gb wire speed). So I'm making the pa820 have layer2 sub int that will bridge to our layer3 cisco svi int and use the svi int as gateways, I'm trying to find the best plan of attack before making changes, thanks in advanced.

Re: Interconnect between layer 3 and layer 2 interface possible?

BPry — Fri, 07 Sep 2018 19:38:23 GMT

@cdcirexx,

See my reply on your discussion topic.

The PA-500 wouldn't achieve wire speed as soon as you enabled either app-id or Threat Prevention, and you likely have both enabled. If you were even getting this to work with a PA-500 in a somewhat respectable manner the PA-820 should perform without issue in the same exact configuration.

Re: Interconnect between layer 3 and layer 2 interface possible?

cdcirexx — Fri, 07 Sep 2018 20:04:41 GMT

Thanks for the reply Bpry, we do have threat prevention and app-id on, and had to move any dbase users to the same vlan cause of the slowdowns, so with the pa820 it should resolve that, I actually went and did the import export already to the pa820, and will change the cables at the end of the day to test.