Using PA220 as a "switch"

L1 Bithead

Using PA220 as a "switch"

Hey all, i got a question that im not sure how to solve.

This is my setup/what i want to do do.


I got a L3 internet line on Ethernet1

On eth2 i got a CAT2960L with vlans 10 and 20.

On eth3 i got a CAT2960L with vlans 10 and 20.


I got 2 2802i with mobility express and i want to use one as a WLC and the other to use that WLC.

One AP will be in VLAN 10 and one in VLAN 20.


I also want the vlans to be able to communicate with eachother, but still be different zones because of different

internet rules ect.


Is it possible for me to use the PA220 eth2 and 3 as "switch ports" and use the PA220 as router/DHCP server?

If so, how is that done? Iv tried with sub-interfaces, but i cant seem to get inter vlan routing to work. Even if i override

Intrazone fw rule. Iv created vlans 10 and 20 on the PA220, iv also set it up as a L2 interface, but that doesnt seem to work either. I seem to get issues with my viritual router, L2 and L3 doesnt mix, i understand why, but i dont know how to get around it.


ANy suggestions are welcome! Im sure some of you guys have done similar stuff before.


Best regards, Marius

L2 Linker

Re: Using PA220 as a "switch"



Regarding inter-VLAN routing: if you do need a routable path between the VLANs, then work with layer 3 subinterfaces instead of layer 2. This way, you can use VLAN tag and/or IP qualifier to assign traffic to your subinterfaces (not main interfaces; you can't >>> Unable to Add VLAN Tag to Layer-3 Interface) and select a Virtual Router for them to communicate, all while keeping them in the same or different zones. If the zone is different, then aside from the route in the VR you'd need the proper Security Policy rule in order for the traffic to pass from one zone to another.


Quick guide on this: Getting Started: Layer 3 Subinterfaces


I don't currently have any experience on your other requirements as to help you :'D

L1 Bithead

Re: Using PA220 as a "switch"

So, it would like somewhat like this then:


Eth1 Internet

I need both these vlans on both switches. 

Eth 2.10 ADMIN

Eth2.20 Datacenter

Eth3.10 ADMIN

Eth3.20 Datacenter


 How can i i solve the DHCP, i cant put one scope on more then one sub-interface, i dont see how this can work.


Best regards, Marius

L1 Bithead

Re: Using PA220 as a "switch"

I solved it with L3 - subinterfaces and another switch 2960L switch.

So im trunking 2 switches into one and trunking that one into L3 interface with subinterfaces. Works perfectly.


Thnx for the feedback.



L2 Linker

Re: Using PA220 as a "switch"

Good to hear!


Sorry I didn't get back to you sooner, but I got caught up with work.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!