topic Re: Need to decide method of Paloalto firewall deployment L3 or vwire in an existing network infra in General Topics

Need to decide method of Paloalto firewall deployment L3 or vwire in an existing network infra

Parthipan — Thu, 02 Jan 2020 19:51:46 GMT

Hi,

I have many sites with different network infrastructure in different countries and i would like to deploy Paloalto firewalls below wan link, please help to to decide method of Paloalto firewall deployment L3 or vwire in an existing network infrastructure

I have been assigned to study the infrastructure and decide L3 or Vwire and to give the justifications on my deciding

Thanks.

Re: Need to decide method of Paloalto firewall deployment L3 or vwire in an existing network infra

OtakarKlier — Thu, 02 Jan 2020 22:04:59 GMT

Hello,

It really depends on the over all architecture and how the current pieces will play what roles or be removed in the future. VWire is good if you want to wait and see what traffic is going through the PAN or if the current network pieces will remain in place and perform the routing. My personal preference is KISS, minimal parts and simple design. So I would say VWire to get the PAN's in and setup your policies. Then move to a layer 3 approach.

Here are a few articles that may help out:

https://docs.paloaltonetworks.com/best-practices/9-0/data-center-best-practices/data-center-best-practices-checklist/plan-data-center-best-practices-deployment-checklist.html

https://live.paloaltonetworks.com/t5/Blogs/Getting-Started-Palo-Alto-Networks-Firewall-Series/ba-p/67707

Cheers!

Re: Need to decide method of Paloalto firewall deployment L3 or vwire in an existing network infra

Brandon_Wertz — Fri, 03 Jan 2020 00:33:36 GMT

@Parthipan wrote:
Hi,

I have many sites with different network infrastructure in different countries and i would like to deploy Paloalto firewalls below wan link, please help to to decide method of Paloalto firewall deployment L3 or vwire in an existing network infrastructure

I have been assigned to study the infrastructure and decide L3 or Vwire and to give the justifications on my deciding

Thanks.

The one thing to consider is requirements and limitation or complications of either deployment. I know vwire deployments can't do somethings that other deployments can (maybe only a L3 type deployment, but I'm not sure.)

For instance though from this Palo page:

https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/networking/interface-deployments/virtual-wire-deployments

"You wouldn’t use a virtual wire deployment for interfaces that need to support switching, VPN tunnels, or routing because they require a Layer 2 or Layer 3 address. "

Re: Need to decide method of Paloalto firewall deployment L3 or vwire in an existing network infra

wahxwah — Tue, 07 Jan 2020 04:32:37 GMT

Personally, I suggested to use the L3 instead of the vwire.

Some reference site : https://www.linkedin.com/pulse/palo-alto-networks-firewall-vwire-mode-alberto-rivai

vwire is proven to be useful in an environment where you do not want or cannot change any L3 domain.