topic Re: extending vlan in General Topics

extending vlan

simsim — Sun, 31 Mar 2019 06:56:43 GMT

Hi,

I have two pa device , if . Both are in two differnet site . and I want to access the device in vlan10 from one site to another .

How can i do that .

vlan 10 ----fw1 --------------fw2---vlan 10

Thanks

Re: extending vlan

Abdul_Razaq — Sun, 31 Mar 2019 13:00:15 GMT

Hi @simsim ,

Are you refferring to L2 extention and will be using same network on both ends?( you are expecting a solution like psuedowire ?)

Re: extending vlan

Raido_Rattameister — Sun, 31 Mar 2019 16:49:58 GMT

Do you have layer 2 or layer 3 connection between sites?

Is connection over internet and IPSec VPN?

Re: extending vlan

simsim — Mon, 01 Apr 2019 05:04:10 GMT

Hi,

I am having l3 connection between sites

Thanks

Re: extending vlan

simsim — Mon, 01 Apr 2019 08:34:23 GMT

Hi,

Not same network , the gateway is in site b.From site a I want to reach site B

Thanks

Re: extending vlan

Raido_Rattameister — Mon, 01 Apr 2019 13:55:27 GMT

Assuming that you configure IPSec VPN between sites then you need to add route to peer site into virtual router and allow this traffic in security policy.

Re: extending vlan

OtakarKlier — Mon, 01 Apr 2019 17:58:30 GMT

Hello,

Are the vlans IP'ed the same way? i.e. 192.168.2.0/24 or do they have different subnets and just the same vlan tag?

Please advise,

Re: extending vlan

ScottF — Mon, 01 Apr 2019 21:59:28 GMT

The best way I've been able to do this is by having a different subnet at each location such as this: 10.10.1.0/24 and 10.30.1.0/24. I create a L3-Interface on both firewalls and create the necessary routers. I then created a rule in Panorama and applied it to both firewalls like so: Trust=>RemoveOffices(10.10.1.0/24,10.30.1.0/24); App-ID: Any, Service: Any => Trust=>RemoteOffices(10.10.1.0/24, 10.30.1.0/24); App-ID: Any, Service: Any. When applied to both sets of firewalls you'll get a psuedo VLAN extention. To make it scale a little, create an Address Group named something like: VLAN1. Then reference that in any rule you create. You must always include Remote-Office (To and/or From) as appropriate. This will allow all traffic originated on VLAN1 on site1 to VLAN1 on site2 (simulates an extended VLAN between sites).

I've used this and it works quite well. The only gotcha you need to be careful of is when specifying the Interface between firewalls. I use a dedicated Interface or Tunnel and keep my routes very specific only to the other site. Any other routes should probably not traverse that link unless it absolutely needs to.

Good Luck!

Re: extending vlan

simsim — Tue, 02 Apr 2019 05:03:20 GMT

Hi,

Why do I need a virtual router ?

Thanks

Re: extending vlan

simsim — Tue, 02 Apr 2019 05:04:46 GMT

Hi,

Same ip and same vlan tag

Thanks

Re: extending vlan

OtakarKlier — Tue, 02 Apr 2019 22:15:58 GMT

Hello,

They cannot be the same IP address for management. If you are doing HA A/P, then the interface will have the same IP but the passive will be shut down since they are 'passive'.

Hope that helps.

Re: extending vlan

simsim — Wed, 03 Apr 2019 08:03:19 GMT

Hi,

Sorry for the confusion , I am not talking about the management ip . What I mean is vlan is same in both sites

Thanks

Re: extending vlan

Abdul_Razaq — Wed, 03 Apr 2019 08:21:07 GMT

Hi @simsim ,

I feel there is a communication gap. hope you need to explain the requirment bit detail.

If you are using different ip segment in both locations, you can have ipsec between two sites, and route the segments through tunnel in both firewall and have a proper security policy.

As vlan is just local to local network, you have L3 connectivity between two locations(and as per commends, you are using diffrent ip segments in both locations), need not to bother about vlan much.

But if you need a L2 extension like psuedowire ( L2VPN), i dont thing PA is having it now.

Re: extending vlan

Raido_Rattameister — Wed, 03 Apr 2019 13:54:27 GMT

If you have Layer 3 in between then it does not matter at all if vlan number is the same or not.

Important is if your IP subnet is the same. In your case it seems to be.

All you have to do is to use NAT at both sides to overcome it.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClNxCAK