Single Interface Trunk Hairpin problem for All traffic traversing Firewall?

Sec101 — Thu, 01 Jul 2021 16:27:35 GMT

Have a site that we want to firewall traffic off into a few segmented zones. I would like to do all of this with 1 management interface, and a single palo alto trunked interface that would carry multiple vlans. To be clear, in this instance, the firewall would already be on the inside of the network and not an edge device.

The firewalled networks would all reside locally at this site, and traverse the trunk over a tagged interface to get back "out" to the rest of our networked sites traversing internet/mpls. Most of the traffic would come into the site on a main tagged vlan (either local computers at site or servers in remote destinations), hairpin to the segmented vlan(s), and then hairpin again - and respond back to the originator at a different interent/mpls site or to the main tagged vlan locally.

Can anyone think of any issues trying to use a single interface for trunking multiple vlans? My concern here is that traffic wouldn't be crossing interfaces in/out, but would be all using a trunk even for it's main data interface. Thinking most admins are using 1 internal interface, and then 1 trunk interface for the rest of the local firewalled networks?

I understand that palo doesn't use native vlanning- so vlan 1 is out of the question if we trunk all of this I'm thinking?

Concerned with hairpin traffic, and any experiences anyone has had experimenting/implementing this.

Re: Single Interface Trunk Hairpin problem for All traffic traversing Firewall?

BPry — Thu, 01 Jul 2021 21:04:33 GMT

@Sec101,

This would work, but the main concern would really be if a single interface would be able to handle your traffic load without issue if it's handling all of the traffic traversing this firewall.

topic Single Interface Trunk Hairpin problem for All traffic traversing Firewall? in General Topics

Single Interface Trunk Hairpin problem for All traffic traversing Firewall?

Re: Single Interface Trunk Hairpin problem for All traffic traversing Firewall?