Best practice for Palo Alto Uplink

L0 Member

Best practice for Palo Alto Uplink

We are looking to deploy our new boxes (PA-3220) in HA in the next few weeks. We are trying to go with best practice methods. 


Currently, we have an Layer 2 ae interface that has multiple subinterfaces. Each subinterface is tagged with a Layer 3 SVI. The VLAN interfaces are IP'd and added to the Virtual Router. 


Example -

Ethernet Tab:

Interface          IP Address             Tag                     VLAN                 Security Zone

ae2                   none                      Untagged           INTERNAL        none

ae2.501           none                      501                     INTERNAL        none

ae2.502           none                      502                     DMZ1                none

ae2.503           none                      503                     DMZ2                none

ae2.504           none                      504                     DMZ3                none



Interface          IP Address             Virtural Router   Tag                VLAN            Security Zone

vlan                  none                       none

vlan.501            VR1                     Untagged     INTERNAL    INTERNAL

vlan.502       VR1                     Untagged     DMZ1            DMZ1

vlan.503     VR1                     Untagged     DMZ2            DMZ2

vlan.504       VR1                     Untagged     DMZ3            DMZ3


My question is, should we have the above setup or should we just have the ae interface as layer 3 with subinterfaces and tagged VLANs across that interface?


Thank you for your insight.

Cyber Elite

Re: Best practice for Palo Alto Uplink


This is something I have put a lot of thought into as well. In my experience it took a bit more time to setup the way you are doing it, but in the long run it was the correct choice for my deployments. What it gives you is a lot more flexibility in the future if you want to change things, I think. 


The way you have it outlined is how I would deploy as well.


Hope that helps.

Cyber Elite

Re: Best practice for Palo Alto Uplink


I'll agree with @OtakarKlier and say that the way you want to go is the proper setup for most deployments. I've seen a lot of people start with a layer-3 interface and just route all outside traffic to the firewall; they then either switch things around with a major re-architecture to get to what you are describing here or they'll break things off via VRF and more layer3 interfaces.

Starting off with a layer2 interface and simply using subinterfaes to terminate the VLANs is simply just going to be better, and provide more flexibility going forward as far as adding VLANs or making other changes go. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!