https://live.paloaltonetworks.com/t5/general-topics/internal-gateway-tunnel-mode/m-p/252147#M71688 <P>What are the implications of using Internal gateways in Tunnel mode? I have 3 Palos on-prem at my datacenters. I have 7 total locations connected via MPLS.&nbsp; I am thinking about using the Internal Gateways in Tunnel mode to prevent cross talk within subnets and force all communications to go through the firewalls.&nbsp; Thoughts?</P> Mon, 04 Mar 2019 14:04:39 GMT ebrookman 2019-03-04T14:04:39Z https://live.paloaltonetworks.com/t5/general-topics/internal-gateway-tunnel-mode/m-p/252147#M71688 <P>What are the implications of using Internal gateways in Tunnel mode? I have 3 Palos on-prem at my datacenters. I have 7 total locations connected via MPLS.&nbsp; I am thinking about using the Internal Gateways in Tunnel mode to prevent cross talk within subnets and force all communications to go through the firewalls.&nbsp; Thoughts?</P> Mon, 04 Mar 2019 14:04:39 GMT https://live.paloaltonetworks.com/t5/general-topics/internal-gateway-tunnel-mode/m-p/252147#M71688 ebrookman 2019-03-04T14:04:39Z https://live.paloaltonetworks.com/t5/general-topics/internal-gateway-tunnel-mode/m-p/252184#M71699 <P>Hello,</P><P>Besides the additional traffic this may cause and additional CPU/Memory on the PAN, I dont see why you couldnt perform this. Sounds like you are trying to follow the Zero Trust model. I fully agree with this model, just make sure your PAN's are speced for the sessions and bandwidth.</P><P>&nbsp;</P><P>Regards,</P> Mon, 04 Mar 2019 17:23:39 GMT https://live.paloaltonetworks.com/t5/general-topics/internal-gateway-tunnel-mode/m-p/252184#M71699 OtakarKlier 2019-03-04T17:23:39Z