DMZ with multiple VLANs, multiple Zones?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

DMZ with multiple VLANs, multiple Zones?

L4 Transporter
If you have a DMZ behind the Palo and it contains multiple VLANs or sub-interfaces, would you create multiple Zones(one for each VLAN)? Or create a single "DMZ" zone and apply that to all of the VLANs?
4 REPLIES 4

L7 Applicator

Hi @jambulo

 

There is no simple answer for your question. It depends ...

  • Are the subnets equal to each other?
  • Will you generally allow traffic between the subnets?
  • Are the subnets contain different group of servers? (One subnet for linux and one for windows for example)
  • Do you plan to configure generic zone firewallrules or do you configure specific rules for each server?

Hello,

I agree with @Remo. The way I do it is use one zone and then create policies around the vlan subnets. This way I dont run out of zones and can keep the traffic highly segregated. This is also because I have an implicite DENY ALL at the end of my rules so the built in intra-zone traffic rules doesnt apply and traffic is denied by policy.

 

Hope that makes sense.

  • Are the subnets equal to each other?
    • Not sure what you mean.
  • Will you generally allow traffic between the subnets?
    • Generally will not allow traffic between subnets.
  • Are the subnets contain different group of servers? (One subnet for linux and one for windows for example)
    • Subnets can contain different types of servers, but mainly are separated by the functions that the servers provide.
  • Do you plan to configure generic zone firewallrules or do you configure specific rules for each server?
    • Specific rules for each server.


@jambulo wrote:
  • Are the subnets equal to each other?
    • Not sure what you mean.

I meant if these subnets are all the same and the only reason you have more than one is mabe because one /24 isn't big enough, so you created a second. But as you wrote you want to group the servers based on their functions.

 

Depending on the number of subnets and the hardware you are using, I would create one zone per vlan/subnet. As you group the servers by their functions this would fit perfectly into the zonenames so you have a better overview in the ruleset.

 

If you have more than 40 subnets and you are using a PA-3020, then you have to go the way with one zone where you drop intrazone traffic, but in case you have a PA-5220 or even bigger then the number of zones will probably not be a limit in any way.

 

 

 

  • 3639 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!