Limitations in virtual wire mode?

[efellows]

Hello all,

I've checked all docs and guides and did not find any documented limitations (such as features not available) when PA is deployed in virtual wire mode. Does this mean that ALL possible features are available both in routed and VWire mode?

For example: if I deploy PA in VWire mode between the Internet router and a L3 Core switch with multiple VLANs. This means that the actual clients/users will not be in the same broadcast domain where the PA is sitting. Nevertheless PA has no IP addresses set, therefore no routing table at all. Should this affect somehow at least some of the features? For example if the PA has to send a TCP reset to a client/server in the inside BEHIND the core swtich. Will this be routed/forwarded properly when there's no routing table at all?

The above was just an example, there might be many more similar cases.

Thanks in advance!

[VinceM]

Hi efellows,

As you write in your question, in Vwire, plao has no IP on interface. Mean it's fully transparent. No routing not NAT no ..... just TRANSPARENT, this is the aim for transparent mode.

For some reason, some feature can be supported in this mode like NAT ... but it's really particular need and not very clean deployment.

Please see: https://live.paloaltonetworks.com/docs/DOC-5725

Hope help

V.

[efellows]

Yes, NAT is an obvious example of a feature that is not supported. My question is: Is there an official and complete list of all such features?

P.S. The link you've provided says "Unauthorized"

[jvalentine]

Actually PAN-OS supports v-wire NAT as of 4.1.  Please see attached tech note re: NAT

- Understanding PAN-OS NAT

[efellows]

OK, but still it would be rather helpful if there's somewhere a document describing (if any) features that are unsupported or have limitations in vwire mode. Or should we consider that there is absolute 1:1 feature parity between routed mode and vwire mode?

[VinceM]

Hi,

Here extract from training 🙂

Hope help.