Connecting L3 Port of Palo Alto to the Switch

[harmander]

Hi there,

On Palo Alto I have configured L3 interface and assgined ip address to it. I would like to connect this interface to the switch. The switch has an SVI configured with the port in the same vlan as the SVI. Can I connect the Palo Alto interface to the switch port which is configured with a vlan or do I need to make the switch port as a routing port.

Thanks Guys

[reaper]

Hi!

the firewall does not participate in STP so layer2 SVI bridging does not work, you can choose either 

•  access port in the svi vlan and add routes that point to the SVI
•  routed port
•  different design: 
• you can also create several (tagged) subinterfaces on the firewall and connect it to a trunk port on the switch and let the firewall do the routing, that way you can inspect inter-vlan traffic
• the firewall also functions in layer2 mode with a layer3 (firewall version of vsi) function you can enable

hope this helps

[darren_g]

---

@harmander wrote:

Hi there,

On Palo Alto I have configured L3 interface and assgined ip address to it. I would like to connect this interface to the switch. The switch has an SVI configured with the port in the same vlan as the SVI. Can I connect the Palo Alto interface to the switch port which is configured with a vlan or do I need to make the switch port as a routing port.

Thanks Guys

---

I do exactly that on my core switches to allow for the HA configuration.

Firewall is configured with an L3 interface, switch cluster is configured with an RVI (Juniper speak, not Cisco), each port for the firewall is a simple access port in the associated VLAN for the RVI. I just post routes to the RVI address.

That way, it doesn't matter which firewall is active at the time - both are connected into the same routes, and an ARP flood when HA failover occurs means I rarely even lose a packet in the event of a HA event.