topic Re: PANOS 10.x - share interface in Multi-vSYS mode in General Topics

PANOS 10.x - share interface in Multi-vSYS mode

psycoma1984 — Thu, 30 Sep 2021 11:04:57 GMT

Hello All,

We are working on a design to move Cisco ASAs firewalls into PA 5260 with Multi-vSys mode enabled, so each Cisco ASA is a separate vSys.

While everything else looks like nice and easy-to-convert, we have problems with shared interface. In Cisco world multicontext ASA might have interface in same VLAN X and SUBNET Y on each context easily.

Is it possible to do the same on Palo Alto platform? I am familiar with Shared Gateway and External Zones, but it doesn't look like it will solve our problems in full. For example we need to have 3 sub-interfaces in same subnet (one per context), is it actually possible to create those and add into single Shared Gateway?

Thanks!

Re: PANOS 10.x - share interface in Multi-vSYS mode

Fabio_Cremona — Thu, 30 Sep 2021 13:15:52 GMT

Hi,

For example we need to have 3 sub-interfaces in same subnet (one per context), is it actually possible to create those and add into single Shared Gateway?

You can configure sub-interfaces with the same IP-Address for different context but you can't have the same subinterface L2 Tag (802.1q) within the same physical interface.

Re: PANOS 10.x - share interface in Multi-vSYS mode

psycoma1984 — Thu, 30 Sep 2021 13:21:37 GMT

Hello Fabio,

Thanks for your reply. Do you know if that's possible to have 'untagged' physical interfaces added to different contexts within same subnet on a PA box? We can 'tag' them to the same VLAN on a switch.

Re: PANOS 10.x - share interface in Multi-vSYS mode

Fabio_Cremona — Thu, 30 Sep 2021 13:21:17 GMT

Yes, it is. You can assign different physical interfaces to different context with same ip space.

Re: PANOS 10.x - share interface in Multi-vSYS mode

psycoma1984 — Thu, 07 Oct 2021 10:10:55 GMT

hello Fabio,

One question more - you mentioned that "can't have the same subinterface L2 Tag (802.1q) within the same physical interface". Does it also mean that I cannot have 2 subinterfaces with same DOT1Q tag within same PORTCHANNEL interface?