inter-vsys vs shared virtual router

[iFAST-SG]

Hi all

It seems like 1 virtual router can be shared by multiple vsys

Reading up

https://knowledgebase.paloaltonetworks.com/servlet/fileField?entityId=ka10g000000UADEAA4&field=Attac...

1 VSYS can have all multiple VR’s as well as multiple VSYS can share the same VR

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/virtual-systems/virtual-systems-overview/v...

If you have virtual systems for departments of one organization, and the network traffic for all of the departments is within a common network, you can create a single virtual router for multiple virtual systems.

========

q1) does that means if i have 1 vr shared by multiple vsys - there is no need for inter-vsys routing ?

========

q2) through where in the GUI can i assign 1 VR to multiple vsys ?

In the interface page, i can assign different interfaces in the same VSYS to different virtual routers

In the vsys page, i cannot assign the same VR to 2 different VSYS - why ?

========

While reading setup on inter-vsys routing

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSVCA0

q3) without turning vsys1 and vsys2 visibility to each other - i am still able to set the next hop in vsys1 vr1 to vsys2 vr2 - how does that work then ?

thank you

[reaper]

1) it simplifies intervsys routing but you still need "external" zone security rules

2) you assign it to all vsys by _not_ assigning it to a vsys

3) if you don't add the visibility you simply created a bad configuration by setting the next hop to a not-visible vsys