I'm having trouble interpreting this link for deployment scenarios of the vm series Palo Firewalls. Looking for clarification...
We have an ESXi cluster with 3 hosts running vSphere Distributed Switches. Our plan is to have one Palo VM-300 in the cluster and it will have the gateways (SVI's) for VM's on all ESXi hosts. I'm questioning if this will work. I'm questioning how a VM on host without the Palo will reach it's gateway.
Can this one Palo take traffic from all VM's across all hosts?
I feel like I'm missing something here.
Can a VM on one ESXi host reach the other VMs running on a different host within your existing network? The answer to that question would really depend on your environment, but the vast majority of environments the answer would be yes. The deployment method that you use really depends on your own network design and actual goals.
Right now I don't have a way to test it as the gateways for all the VM's will be on the Palo VM. I'm pretty sure all VM's on the physical ESX host with the Palo VM will be fine. What I'm worried about are the VM's that are on other ESX hosts that do not have the Palo.
Does that make sense?
I'd like to give some additional details on this as I'm still looking for feedback and am a little confused.
See attached picture. It represents one physical ESXi host of a cluster of 3. I'm curious if this setup would work and allow network connectivity between VM's on vlans 68 and 69 across all hosts. Please let me know if more detail is needed to answer this question. Thank you!
From what I remember trying to architect something like this, you would need a PAN on each ESXi host. If you just have one it will/might create major routing issues if the ESXi host the PAN is running on get rebooted etc.
Just another thought. What if instead of your physical switch you had a physical PAN's, 2x in HA,? This way it would all be layer 2 vlans to the PAN and they are all anchored there? Just thinking out loud.
Thanks for all the replies, I ended up getting my original setup working across all ESXi hosts. Even performed some vmotions of the VM's and even the Palo. VM's were fine to vmotion....with the Palo, things were down for about 30 seconds.
Now, I'm having issues with the zones. I can't create any more than 15 even though I have the VM-300 license installed.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!