How do I create a 2GB aggregate interface on PA-2050, not HA

[ejm]

All,

I have a client that wants to aggregate two sets of interfaces in vwire on a PA-2050 to create a 2GB etherchannel.  Is this possible?  If so, can someone tell me which document contains the steps to create this?

Thanks!

ejm

[jvalentine · Accepted solution]

If you're using v-wires, the best way to do this is to setup the devices on either side of the firewall to do the link-aggregation.  See this document:

-

[ejm]

J, Thanks!

[mikand]

According to release notes for PANOS 5.0:

Link Aggregation – The PA-500 and PA-2000 Series devices now support link

aggregation. Note that link aggregation on virtual wire interfaces is not supported on the

PA-2000 Series due to a hardware limitation. By assigning common ingress and common

egress zones, two or more virtual wires may still be used on the PA-2000 Series in

environments where adjacent devices are performing link aggregation.

Which means:

1) Setup 2 zones (internal and external or whatever you choose to call it).

2) Enable VWire so int1+2 is internal and int3+4 is external (or whatever combo you like) - that is VWire1 is int1+3 (internal/external) and VWire2 is int2+4 (internal/external).

3) On the devices before/after the PA box setup etherchannel and connect this through the PA device (that is for example int1+2 on device1 will form etherchannel with int1+2 on device2 - then connect device1_int1 to PA_int1, device1_int2 to PA_int2, device2_int1 to PA_int3, device2_int2 to PA_int4 (or whatever interfaces you setup for this)).

4) Dont forget to configure which VLANs you allow through this VWIRE.

This way the PA will not be part of the linkaggregation itself but more like if you would connect a hub between device1 and device2 interfaces (that is one hub for deviceX_int1 and another hub for deviceX_int2).