topic Enabling multi vsys on a prod firewall. in General Topics

Enabling multi vsys on a prod firewall.

mudassar216 — Thu, 15 Apr 2021 04:33:09 GMT

I’m planning to create multi vsys on my palo alto. I just wanted to know if my existing configuration (interfaces, aggregate interfaces and rulebase) will be moved as it is to vsys1 or they need to be mived manually?

I have aggregate interfaces layer 2 in my environment so I need to assign vlan interfaces to vsys and keep parent port in no vsys or an admin vsys. Will that work?

Re: Enabling multi vsys on a prod firewall.

mudassar216 — Thu, 15 Apr 2021 11:29:45 GMT

I checked and my assumption about rulebase and configuration part was correct. Everything is under same vsys i.e vsys1.

But i’m not sure about assigning aggregate interface with no Vsys, as Every interface needs vsys configuration.

Re: Enabling multi vsys on a prod firewall.

BPry — Thu, 15 Apr 2021 23:14:51 GMT

@mudassar216,

So everything you already have configured is technically already in vsys1 outside of shared objects, so nothing really "moves" when you enable multi-vsys as it's already present in the default vsys1. So every interface you have configured, including your aggregate, is already technically in vsys1.

Your aggregate interface needs to be assigned to a vsys and can't be left unassigned. I've never honestly tried having the VLANs split out between vsys coming across an AE assigned to another vsys, but I would guess that this would be an invalid configuration.

Re: Enabling multi vsys on a prod firewall.

mudassar216 — Fri, 16 Apr 2021 01:16:13 GMT

@BPry

Yes the first part is correct. I already tried it 🙂

For the aggregate interface, what I did is removed the agg interface itself from under vsys and kept it’s vlan interfaces in required vsys. I was able to do that but I couldn’t test if the setup was working. Will check and confirm.