topic Re: Layer 2 to Layer 3 Connection , but on same Subnet and IP range? in General Topics

Layer 2 to Layer 3 Connection , but on same Subnet and IP range?

eveares — Tue, 04 Feb 2020 21:04:30 GMT

We have a PaloAlto PA220 at work what is used for telephony/SIP traffic that I set up several months ago.

Upstream of the PaloAlto is a unmanaged L2 netgear switch what sits between the leased internet line, the PaloAlto , and a another non-PaloAlto firewall. I want to get rid of this unmanged L2 netgear switch and connect our other non-PaloAlto firewall and the Internet leased line directly into the PaloAlto.

The thing is is through the PaloAlto has a external IP of 5.X.X.36/28 and the non-PaloAlto firewall has a IP of 5.X.X.34/28, and following the guide linked below fails (commit fails) due to setting the VLAN interface IP to 5.X.X.34/28 overlaps and conflicts with 5.X.X.36/28. Both the PaloAlto and the non-PaloAlto firewall both use the same ISP gateway (5.x.x.33/28.)

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKMCA0

How do I get around this issue and connect our non-PaloAlto firewall into the PaloAlto firewall so that the Layer 2 switch can be got rid off.

Regards: Elliott.

Re: Layer 2 to Layer 3 Connection , but on same Subnet and IP range?

RobinClayton — Wed, 05 Feb 2020 08:28:13 GMT

If the other firewall has 5.X.X.34 , then it's going to conflict if both are the same?? Or are you getting rid of the other firewall?

Rob

Re: Layer 2 to Layer 3 Connection , but on same Subnet and IP range?

eveares — Wed, 05 Feb 2020 13:55:19 GMT

The other firewall is our main corporate Checkpoint branded firewall and can not be got rid of. Yes it uses a IP on the same subnet and the same default gateway as the PaloAlto firewall.

I essentially want to integrate the layer 2 switch into the PaloAlto so the layer 2 switch is not needed anymore.

Regards: Elliott

Re: Layer 2 to Layer 3 Connection , but on same Subnet and IP range?

jeremy.larsen — Wed, 05 Feb 2020 14:00:50 GMT

I don't think you've provided enough information here for people to help you. A diagram would be nice. I am guessing you want to use your PA-220 as a switch just so you can remove some equipment. On the surface, you can do this but it sounds like a really bad idea. Is there a technical reason you want to remove this switch?

Re: Layer 2 to Layer 3 Connection , but on same Subnet and IP range?

RobinClayton — Wed, 05 Feb 2020 14:59:14 GMT

So the L2 Switch has the

Internet on one port.

PA on another port

Checkpoint on another port.

All there in the same vlan.

Personally that's how I intend my external infrastructure to be, I can then have multiple ISP's and trusted their part circuits on different VLANS going to any combination of firewalls.

Re: Layer 2 to Layer 3 Connection , but on same Subnet and IP range?

ddelcourt — Wed, 05 Feb 2020 16:24:36 GMT

@RobinClayton so, I think the issue you are having is that you are trying to prestage the PA220 by creating the second interface in the same subnet before you deprecate the existing one... if this is the case that explains the error as PANOS will not let you do that in the same VR IIRC.

As for removing the L2 switch and directly connecting that should be OK, based on what we know at this point, so long as your upstream CP FW is not in HA and doesn't need a common L2 to accommodate...

Assuming below is a simple representation:

The L2 switch should not be needed... could you just leave the configs as-is and directly connect the CP/PA FWs directly?

Re: Layer 2 to Layer 3 Connection , but on same Subnet and IP range?

eveares — Wed, 05 Feb 2020 20:13:25 GMT

Please see below for the topology diagrams. It is to note the Checkpoint firewall can not be changed and is out of my control.

The PaloAlto firewall servers as the route for SIP/VOIP traffic, and the Checkpoint firewall servers as the route for all other traffic.

Current Topology:

Wanted Topology:

Regards: Elliott.

Re: Layer 2 to Layer 3 Connection , but on same Subnet and IP range?

jeremy.larsen — Wed, 05 Feb 2020 20:59:59 GMT

If it were me, I would prefer the setup you currently have over the proposed. I'm still trying to see what you are trying to accomplish or gain here. I don't like forcing Layer 2 through a PAN. You can do it but I wouldn't unless I was forced.

Re: Layer 2 to Layer 3 Connection , but on same Subnet and IP range?

OtakarKlier — Wed, 05 Feb 2020 23:35:18 GMT

Hello,

In all honesty, I dont think your 220 could handle the traffic. And you might not have enough ports to do vwire plus you would still need a switch between the pan and leased line. If you made the PAN interfaces L2, you still need a L3 interface for it to route the sip traffic so you would need a L3 vlan interface for that.

However depending on the traffic through the CheckPoints, i still dont think the PAN could handle the traffic.

Regards,

Re: Layer 2 to Layer 3 Connection , but on same Subnet and IP range?

RobinClayton — Thu, 06 Feb 2020 08:50:39 GMT

Otakar eludes to the V-Wire, which would allow traffic to traverse the PA seamlessly, but in that scenario, as he points out, you would need bot a trusted and untrusted v-wire ports. And the untrusted v-wire and external interface still both need to connect to the Leased line somehow.

The present setup is really correct for most instances.

Or are you trying to get rid of £$ threat inspection licences on the checkpoint and put that into the PA??

Rob

Re: Layer 2 to Layer 3 Connection , but on same Subnet and IP range?

ddelcourt — Thu, 06 Feb 2020 16:49:25 GMT

I would agree with @RobinClayton @OtakarKlier @jeremy.larsen here... this is not simply getting rid of a switch but also redesigning your outbound traffic layer... today, specific traffic (SIP/VoIP) is directed via some kind of route engineering (I assume) to go thru the PA220 and the rest is engineered to go thru CP and bypass the PA220... the proposed design now puts the PA220 in line with the CP and capacity issues aside you still need a common L2 north/south of the CP FWs for HA to work and pushing that to the PA220 is just moving the same functionality to a new spot...

If full resiliency is required, you have HA on the CP FWs, then having redundant L2 switches north/south gets you there as a failure on either switch means use lose outbound connectivity regardless of the HA on the CP FWs.

On the capacity front it would be recommended to understand the traffic load/rates currently going thru the CP FWs and add that to what the PA220 is currently doing to see if it can handle the additional load, you still would have a SPOF as the PA220 is not in HA...

Lots of things to consider, perhaps reaching out to your SE to have a more detailed conversation on this would be a good next step.

Re: Layer 2 to Layer 3 Connection , but on same Subnet and IP range?

eveares — Thu, 13 Feb 2020 15:29:56 GMT

I should mention that what I want to do, we are currently doing with another/2nd PA-220 that we have that handles both the 1) gateway for our public Wi-Fi what 2) also feeds our main checkpoint firewall for another connection on the Checkpoint.

But in that case the Wi-Fi (using the PalAlto as the layer 3 router) and the connection to our Checkpoint Firewall (via a layer 2 to layer 3 connection on the Palo Alto) are using completely different subsets with their own distinct gateway.

I was hoping I could do the same thing with the PaloAlto PA220 that handles the SIP traffic and the Layer 2 connection from the unmanged switch to the Checkpoint firewall that both use the same subnet as originally proposed in this thread.

Regards: Elliott.