Palo Alto in Cisco network with VRF lite

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Palo Alto in Cisco network with VRF lite

Not applicable

BRosenba asked this question last year.  "We've recently purchased an HA pair of PA 5050s. We are planning to utilize the devices in cooperation with some Cisco core switching hardware and VRF lite to segment/secure internal traffic as well as traffic to the Internet."

Is there a layer 3 solution with the Palo Alto?  The Cisco core switch has two routing tables and one physical connection to the PA.  Is it possible for two internal addresses each in a different routing table to communicate using the PA as the intervening firewall?

Thanks,

Ann

1 REPLY 1

L6 Presenter

There are various setups described in these docs which I guess might be helpful in your case:

Designing Networks with Palo Alto Networks Firewalls

https://live.paloaltonetworks.com/docs/DOC-2561

Diagrams and Tested Configurations

https://live.paloaltonetworks.com/docs/DOC-2560

Even if PA will work as "router on a stick" you will get better performance throughput if you utilize more than one cable for all your traffic (like a physical interface as inside and another as outside).

If im not mistaken QoS doesnt work on aggregated interfaces today (I think this is already setup to be fixed in future releases) but this is only good to know if you will use QoS in your PA (otherwise you can let the routers do the QoS for you).

You can also setup VSYS in PA to virtually split the dataplane for various uses (given that you trust stuff such as VRF and VSYS etc).

When it comes to performance - instead of using your two PA's in a active/passive cluster (or active/active for asymmetric routing (note that the total performance is still the same of active/passive) you can configure them as two independent boxes and use panorama to make the configuration easier for the administrator. This way the routers can perform ECMP (Equal Cost MultiPath) to loadbalance between the two independent PA's (and make sure to use hash(srcip+dstip) as loadbalance algo) and by that you will get twice the performance through your PA "cluster".

  • 4363 Views
  • 1 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!