I'm trying to put together a plan of action to get globalprotect to work for us. I have a work ticket open with PA. Our PA firewall is currently deployed in a VWire setup, on the lan side of our router. Here are my big questions for getting this accomplished.
1) If I switch the vwire to layer 3 can I migrate the security profile name so I don't have to re-write every security policy?
2) Can the establishment of a virtual router on the layer 3 interface disrupt existing routes established by our physical router? This may be a silly question here. I'm just wondering if establishing a virtual router behind our physical one would disrupt or block any existing traffic routes, or if it would only momentarily establish new routes with RIP or the like.
(A) If you are planning to change the config from Virtual-wire to Layer-3, you need not to re-write all security policies again.
1. You have to change the interface type, from vwire to Layer-3.
2. Change the Zone type from vwire to Layer-3
(B) If i understand your query correctly,you can create a new virtual router for a Layer-3 interface and It would not impact on your existing routes established by your physical router. Until and unless you are not pointing any route to that/from Virtual router. Virtual router is a logical separation of routing table inside the same physical device.
Let us know if you need further information on this.
Thank you very much. It is a great relief to not have to re-write the policies.
About the virtual router. I'm not trying to disrupt existing routes, but an only trying to make globalprotect portal and gateway work.
For your question 'A' Instead of re-writing security policies I'd recommend to change source and destination zones to any and then change zones from v-wire to L-3 and then refer the new zones in your security policies.
Hope it helps.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!