Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
02-25-2024 10:02 PM
Say I want to connect this port to a switch downstream (trunk), with clients hanging off of switch on access ports and use vlan interfaces for routing. Switch is set to trunk allowing relevant vlans, the firewall interface is subinterfaced (layer2) with the respective tag and vlan assigned. This is not working. DHCP does not work at all. Can someone let me know if I am doing this correctly? I am having trouble getting this configured.
IE:
FW <trunk>Switch<access>Client
FW eth1/3 subinterfaced (eth1/3.600 - layer2) with tag and vlan. Vlan exists and is pointing to the vlan.600 interface.
When I have a physical interface assigned to a vlan, and a client directly plugged into the firewall port, DHCP/traffic works as expected.
I am accustomed to using layer3 subinterfaces, but this had me curious so I wanted to try it.
02-26-2024 05:43 AM
you need to have 2 "vlans" (it's a bit of unfortunate naming on Palo's side)
one is a layer2 vlan assigned to your subinterface that determines which interfaces belong to the same vlan and zone regardles of their tag (this is virtual layer 2 inside the chassis)
the other is the vlan interface, which is like a VRF (found in the interfaces > vlan tab). this is where you set a vlan interface up with an ip address so it can function as a default route, and this interface can be used to attach a DHCP server
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
