topic Re: Configuring external connection through a switch in General Topics

Configuring external connection through a switch

fa2019 — Fri, 14 Feb 2020 15:10:07 GMT

Hi,

Initial config query! We currently have 2 leased lines going into a managed switch for failover capabilities with then a single cable going into our existing firewall (Zywall).

This weekend we would like to switch out the existing firewall with our new PA-850 but retain the managed failover switch within the dataflow (this will be replaced in a months' time so that both leased lines go directly into the PA-850).

On our current firewall, the port connected to the managed switch is configured as:
IP: xxx.xxx.xxx.21
Subnet Mask: 255.255.255.240
Gateway: xxx.xxx.xxx.17

As I try to configure the interface on the PA-850, I've assigned ethernet1/1 as a Layer3 interface with a static IP address using the same xxx.xxx.xxx.21 but am unsure if this is the best way and if I need to enter the subnet mask and gateway information anyway.

In terms of data flow:
Internet > ISP1 router + ISP2 router> Switch handling failover > Ethernet 1 on PA-850

Advice would be appreciated.

Many thanks in advance

Re: Configuring external connection through a switch

OtakarKlier — Fri, 14 Feb 2020 17:44:13 GMT

Hello,

While I cant recall ever doing it with one port, it might be possible if you use sub-interfaces.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLL8CAO

I tend to make my physical ports layer2 and then make a layer 3 vlan, but thats more preference than anything.

Hope that helps.

Re: Configuring external connection through a switch

SutareMayur — Sat, 15 Feb 2020 17:25:13 GMT

Hi@OtakarKlier ,

Are you suggesting to give VLAN tagging on firewall sub interfaces?

Mayur

Re: Configuring external connection through a switch

SutareMayur — Sat, 15 Feb 2020 17:26:43 GMT

Hi @fa2019 , configuration that you have planned should be fine. It'll work as expected.

Mayur

Re: Configuring external connection through a switch

Networker_Raj — Sun, 16 Feb 2020 16:02:48 GMT

Yes it should work.