- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
04-15-2013 05:28 AM
Hi all,
Its my first post here so I hope someone can answer my question regarding vwire subinterfaces.
As I was looking through the older topics the thing I want to achieve is similar to this.
https://live.paloaltonetworks.com/message/9679#9679
however I want to use vwire subinterfaces instead of L2.
According to course material it can be done.
Basicly I want to create differnet policies between different zones with vwire subinterface.
switch (trunk - allowed vlans 123,812) -------------- PAN (vwire LAN) ------------- (trunk) cisco ASA
I have 4 zones
Trust-LAN
Trust-NAVIS
Untrust-LAN
Untrust-NAVIS
with this configuration traffic can't pass the PAN (with "none" set as security zone on physical interface)
traffic flows only if the main interfaces has a security zone assigned to it, but then all traffic is considered to be from this zone.
Can I differentiate vwire subinterfaces or not ( I mean zones on subinterfaces)?
thx for help
04-17-2013 01:30 AM
Przemek,
Please click on New Virtual Wire and create one for this subinterface. I did it for my PA-200 but can't test if it works as expected.
Seweryn
04-17-2013 12:55 AM
Hello,
Not sure (have not tested yet) but it looks like you did not do a VLAN/vwire config for your subinterfaces?
Regards,
Seweryn
04-17-2013 01:12 AM
Hi Seweryn,
What do u mean by not configuring a Vlan/vwire on subinterfaces?
As it is written in coursebook subinterfaces inherits vlan/vwire config from main interface. I can set it on the main interface but after that there is no choice for subinterface to have the same vwire assigment (casue this vwire was already used)
from the book:
Note that you do not specify the virtual wire object during the creation of the subinteface. Since the subinterface is built on an existing virtual wire interface, the virtual wire object is inherited from parent interface. However, the subinterface and parent interface can be configured on different zones
I have vwire crated (its called LAN)
have ethernet 1/1 assigned to LAN.
then have no option for subinterface.
But i think this in not the problem. The main issue is that even though I've got different security zones assigned to subinterfaces the traffic flows only when main interfaces is assigned to it as well. As a consequence subinterfaces inherits it from main interface (the proof is in logs) so I cant diferentiate traffic based on ZONES.
regards
Message was edited by: Przemyslaw Konitz
04-17-2013 01:30 AM
Przemek,
Please click on New Virtual Wire and create one for this subinterface. I did it for my PA-200 but can't test if it works as expected.
Seweryn
04-17-2013 02:19 AM
great - it worked
after modifications
so this is not true what the book says
Note that you do not specify the virtual wire object during the creation of the subinteface. Since the subinterface is built on an existing virtual wire interface, the virtual wire object is inherited from parent interface. However, the subinterface and parent interface can be configured on different zones
...
The subinterfaces allow you to separate and classify traffic into different zones by either VLAN tags or VLAN tags in conjunction with IP classifiers (address, range, or subnet.)
...
thx Seweryn
hope to be in touch
regards
Przemek
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!