Creating VLAN's,.

[Gururaj]

Hi All,.

How to create VLAN's in PaloAlto?

Created VLAN interface 1 (ip 10.10.10.1/24) and created the vlan "sales" for this VLAN interface.(configured zone, applied to default router)

Created VLAN interface  2 (ip 10.10.20.1/24) and created the vlan "Accounts" for this VLAN interface.(configured zone, applied to default router)

For above scenario which physical interface needs to connected to layer 2 switch and how to define that port as a trunk? what are the setting needs to be done for that physical interface?

I am totally confused,..kindly help me to understand this concept.

Regards,

Gururaj

[bdeschut]

You should not use vlan objects, you can go ahead and delete those. Select the physical interface on which the trunk is connected and create L3 subinterfaces on it. Put them in the default router, assign a VLAN ID, put them in a zone and create a policy.

[kprakash]

You have to first configure an interface or a sub interface as a layer 2 type

Then use this interface/ sub interface under the Vlan that you have configured.

When you configure multiple sub interfaces under the physical interface, it automatically becomes a trunk port, like shown below. Ensure that when connecting to a switch, the switch ports should be configured with the same vlans that have been configured on the sub interfaces on the PAN

[mbutt]

Hi Gunraj,

Following doc explains how you can create VLAN's.

https://live.paloaltonetworks.com/docs/DOC-2011

The doc has different scenrio's explains in it.

Please let us know if this helps.
Thanks

Numan

[dbatrankov]

No, this doc doesnt have requested information. VLAN tags translation is done on single L2 interface with L2 subinterfaces put into different VLANS as kprakash desribed above. Also I have question if we need to have security policy or put interface to single Security Zone?

[dbatrankov]

Securing Inter VLAN Traffic has the answer in Case 2a at page 9.