Layer 2 Palo Alto to 802.1q subinterface on Cisco ISR

[MichaelMedwid]

I am thinking to put a small pan between an Internet connected Cisco 4331 ISR and a Meraki switch. Will the PAN just pass all the tagged frames along and will the PAN be able to process the traffic from all those VLANs/tagged frames? Or would I need to configure VLANs on the PAN?

[Cisco ISR 4331]-Int Gi0/0 0/0.1 0/0.2 0/0/3------[L2 PAN]-----------802.1q Trunk[Meraki 225]

[OtakarKlier · Accepted solution]

Hello,

Its better to either use v-wire or a Layer3 interface. I think you would like little disruption to your design so vwire is probably the best way to go.

Here is some information overload ;).

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClS2CAK

https://live.paloaltonetworks.com/t5/Blogs/Getting-Started-Palo-Alto-Networks-Firewall-Series/ba-p/6...

Cheers!

[MichaelMedwid]

So on this new gig my predecessor actually setup virtual wires behind an ASA. But in 

that setup the wires to the ASA and to the switch behind it have no trunking, just a 

single VLAN. If I put trunking on the upstream ASA and downstream switch, would

the PAN be able to see the traffic for all the different VLANs and process rules

accordingly?

[OtakarKlier · Accepted solution]

Hello,

Yes this is possible. Check out this article.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFwCAK

Regards,

[MichaelMedwid]

Very helpful! Thank you.