topic Re: Layer 3 Subinterfaces VM-Series Firewalls VLAN 4095 in General Topics

Layer 3 Subinterfaces VM-Series Firewalls VLAN 4095

Sec101 — Thu, 21 Jan 2021 23:20:39 GMT

When it comes to vm series firewalls, Layer 3 subinterfaces, trunks and port groups, are there any downsides/catches/cautions to setting the ESXI port group to use vlan 4095 (trunk), and then simply utilize layer 3 subinterfaces on the vmseries firewalls with 1 NIC? Article noted below, using just like a normal trunk if I understand correctly? Seems to work as expected as long as I have the TAG number on the firewalls interface. Wondering if anyone has had problematic experiences with a setup like this? I don't think we've ever used a trunk interface marked as 4095 going to anything. Plenty of switching trunks and cisco routers on a stick, but never from an ESXI host trunking to a virtualized palo alto with layer 3 interfaces. Should work as expected?

https://kb.vmware.com/s/article/1004252

Re: Layer 3 Subinterfaces VM-Series Firewalls VLAN 4095

reaper — Thu, 21 Jan 2021 23:33:06 GMT

it kinda depends on the 'size' of your vm. The larger vm's (700) spread the load over their internal CPU cores based on the source interface, which could be a limiting factor if you put everything on a single interface. other than that there shouldn't be any issues

Re: Layer 3 Subinterfaces VM-Series Firewalls VLAN 4095

Sec101 — Thu, 21 Jan 2021 23:37:28 GMT

@reaper

-pleasure hearing from you. Very good to know!