Layer 2 to Layer 3 Connection , but on same Subnet and IP range?

L2 Linker

Re: Layer 2 to Layer 3 Connection , but on same Subnet and IP range?

I would agree with @RobinClayton @OtakarKlier @jeremy.larsen here... this is not simply getting rid of a switch but also redesigning your outbound traffic layer... today, specific traffic (SIP/VoIP) is directed via some kind of route engineering (I assume) to go thru the PA220 and the rest is engineered to go thru CP and bypass the PA220... the proposed design now puts the PA220 in line with the CP and capacity issues aside you still need a common L2 north/south of the CP FWs for HA to work and pushing that to the PA220 is just moving the same functionality to a new spot...


If full resiliency is required, you have HA on the CP FWs, then having redundant L2 switches north/south gets you there as a failure on either switch means use lose outbound connectivity regardless of the HA on the CP FWs.


On the capacity front it would be recommended to understand the traffic load/rates currently going thru the CP FWs and add that to what the PA220 is currently doing to see if it can handle the additional load, you still would have a SPOF as the PA220 is not in HA...


Lots of things to consider, perhaps reaching out to your SE to have a more detailed conversation on this would be a good next step.

L1 Bithead

Re: Layer 2 to Layer 3 Connection , but on same Subnet and IP range?

I should  mention that what I want to do, we are currently doing  with another/2nd PA-220 that we have that handles  both the 1) gateway for our public Wi-Fi what  2) also feeds our main checkpoint firewall for another connection on the Checkpoint.


But in that case the Wi-Fi (using the PalAlto as the layer 3 router) and the   connection to our Checkpoint Firewall (via a layer 2 to layer 3 connection on the Palo Alto) are  using completely different subsets with their own distinct gateway.


I was hoping I could do the same thing  with the PaloAlto PA220 that handles the SIP traffic  and the Layer 2 connection from the unmanged switch to the Checkpoint firewall that both  use the same subnet as originally proposed in this thread.


Regards: Elliott.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!