topic Re: Relevant Zone for an IP address in Vwire in General Topics

Relevant Zone for an IP address in Vwire

nsrini1991 — Tue, 09 Oct 2018 08:28:53 GMT

Hi Experts,

Could you please suggest how to find Relevant Zone for an IP addresses in V Wire mode. When configuring security policy, we need to mention the source and destination zone.

We've PA firewalls only configured in Vwire with multiple zones.

Please suggest is there any way we could check it from GUI or from CLI an relevant zone for an IP address.

Re: Relevant Zone for an IP address in Vwire

OtakarKlier — Tue, 09 Oct 2018 20:57:34 GMT

Hello,

Would you be able to clarify/expand on what is meant by 'relevant zone for an IP address'.

Regards,

Re: Relevant Zone for an IP address in Vwire

nsrini1991 — Wed, 10 Oct 2018 07:35:24 GMT

Hi Klier,

When confuring access rules we'll be specifying the zones for the source and destination addresses. In L3 mode, we'll find the appopriate zones by looking at the Routing table.

Since Vwire acts as bump in the wire (L2) and no routing table is populated, not sure how to calcuate the zones for the source and destination addresses.

Could you please assist.

Re: Relevant Zone for an IP address in Vwire

BPry — Wed, 10 Oct 2018 13:46:20 GMT

@nsrini1991,

I guess generally most people would just know this information without having to look it up. You could put the IPs in as a comment on the associated interface; or you could set them up in the User-ID 'Included Networks' for that zone.

Re: Relevant Zone for an IP address in Vwire

OtakarKlier — Wed, 10 Oct 2018 13:57:00 GMT

Hello,

I have always used a special zone for vwires, that way since traffic is flowing 'between' zones, I can create policies around it to allow/block specific traffic, etc. Here is a guide that may help out.

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/networking/virtual-wire-deployments

I usually use vwires for external devices, say video conference equipment. Then I create zones for the vwire, vwire-external and vwire-internal. Then just create your policies on source and/or desitnation zones.

Hope that helps.