- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
12-22-2021 07:24 PM
Hello,
I have a PA-220 firewall. There is a normal switch connected on ethernet 1/4. The switch is connected to the equipments of 2 network segments, 10.1.240. * and 192.168.5. * .
These equipments need to communication now. But I can't change their IP. Can I do this through the port settings of the firewall?
My idea is to add a new sub port to ethernet 1/4 and set it to 10.1.240.*. Then I will add a NAT to connect ethernet 1/4 and the sub port. Is it right?The pictures are the current settings of the firewall.
I have just started to learn the settings of network structure. There are too many concepts in it. 😥 Do you have any recommended learning materials?
Thanks
12-23-2021 02:17 AM
Hi @xiaolin01
So basically what you need is to add another network segment to the firewall, but that network segment is using ethernet1/4 that now has an untagged VLAN assigned.
You need to first see how the switch is configured for 10.1.240. * and 192.168.5. *. Does each subnet have a 802.1q VLAN-ID assigned to it?
Assuming both have VLAN-IDs you need to add a sub-interface on ethernet1/4 and configure 10.1.240.x/yy on it along with its VLAN-ID.
Next if 192.168.5.* has a VLAN-ID you will need to create another sub interface for it and move the configuration there because once you create a sub-interface - the 'parent' ethernet1/4 will be the untagged VLAN - and this all depends on the switch configuration.
Next configure a trunk port on the switch and move the connection between sw<->fw to trunk (trunk ports can carry multiple VLANs).
Lastly - verify rulebase allows this zone communication.
I will start without NAT at the moment to see if basic communication is working.
Shai
12-23-2021 07:43 AM
Hello,
You will not need a NAT. The above information is correct. I just posted a similar config (it does not use sub interfaces, but the concepts are the same).
https://live.paloaltonetworks.com/t5/general-topics/cannot-reach-server-at-dmz-via-nat/td-p/455022
Regards,
12-23-2021 05:51 PM - edited 12-23-2021 06:41 PM
Thank you.@ShaiW
The switch is a unmanaged switch. So I think I need to make it in the firewall.
Neither of 10.1.240. * and 192.168.5. * have a VLAN-ID.
Do I need to make 2 sub interface?
e.g. ethernet1/4.1 and ethernet1/4.2, configure them and than make a trunk between e1/4.1 and e1/4.2. Or can I make a trunk between e1/4 and e1/4.1?
12-24-2021 08:32 AM
Hello,
If you want to use vlan id's then go with your first option, ethernet1/4.1 and ethernet1/4.2. Make them all layer2 interfaces and put the IP on the VLAN in the firewall. It give you more flexibility (my opinion).
Regards,
12-25-2021 01:11 AM - edited 12-25-2021 02:09 AM
Thank you. I will try.
I set it up and changed e1/4 to layer2.
But my interface is different from yours. I don't know how to set it in static routing (picture 5).
1
2
3
4
5
12-26-2021 02:43 PM
Hello,
For the Next-Hop, use the vlan instead of an IP Address.
Regards,
12-28-2021 08:34 PM
😅Sorry, I have made the same config as your post. But it doesn't work. When I set my IP to 10.1.240.*, I can not ping 10.1.240.1 and 192.168.5.* When I use 192.168.5.* the situation is the same.
Interface
Interface -Vlan
Zones
Vlan
Routes
Policies
12-30-2021 07:40 AM
Hello,
The switch port you plugged PA port 1/4 into, is it setup as a trunk port? Also in order to ping a PAN interface, your management profile must allow for ping.
Regards,
12-30-2021 06:15 PM
Hello,
😥Sorry, I forgot to setup trunk port. The switch is old and unmanaged, it's a layer2 switch. I can't set it.
Can I make trunk port on firewall? I didn't find where to set it. Or should I buy a new layer3 switch?
Regards,
12-31-2021 10:14 AM
Hello,
I would setup two interfaces on the PAN with layer 3 vlan interfaces. Then setup vlans on the switch.
Cheers!
01-01-2022 04:47 AM - edited 01-01-2022 06:29 AM
Hello,
Sorry, I don't understand you. There is no setting options on my switch. I don't understand where I can make setting about vlan or trunk on the switch.This is it's manual.
https://static.tp-link.com/manual/2021/202107/20210719/7106509291_TL-SG1016DE_IG.pdf
I have a another new switch that can log in and make setting. But I think the switch connecting the two networks does not have that.😥
Regards
01-03-2022 08:46 AM
Hello,
Doesnt look like the switch can be managed. You might be able to get away with plugging PAN interfaces 1/1 and 1/4 into the switch and then the devices into the same switch. Not the best solution but should work.
Regards,
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!