Mulit-Vsys setup with Wildfire

[sandeepsutar]

Hi Friends,

We are planning for a multi-vsys PA setup, where one vsys will have only L3/L4 policies and second vsys will be in L2 bridge mode with Threat prevention features only.

Vsys1 will only scan L3/L3 policies while vsys2 will scan traffic for any threats.

We believe this is logically possible solution, need some clarity on integrating Wildfire appliance in this architecture. Wildfire will be connected via 1 Mgmt and 1 VM interface, and it will be interfaced in vsys2 (bridge mode).

Just needed your inputs, if this setup is workable, if yes, can bridge mode vsys forward traffic to wildfire through its Mgmt interfaces for unknown files sampling?

Appreciating your valuable inputs.

Regards,

Sandeep

[victoria88paul]

Hi Sandeep,

Your proposed setup sounds logical and feasible. Integrating the WildFire appliance into this architecture is indeed possible. Here are some key points to consider:

Interface Assignment: Ensure that the WildFire appliance is correctly connected via the Management (Mgmt) and VM interfaces. This setup will allow it to receive traffic for analysis1.

Bridge Mode vsys: Since vsys2 is in L2 bridge mode, it can forward traffic to the WildFire appliance. However, it's important to ensure that the traffic forwarding is configured correctly to send unknown files for sampling1.

Traffic Forwarding: Yes, the bridge mode vsys can forward traffic to WildFire through its Management interfaces for unknown file sampling. Make sure that the necessary policies and rules are in place to allow this traffic forwarding.

Configuration: Verify that the WildFire appliance is properly configured to receive and analyze the forwarded traffic. This includes setting up the appropriate interfaces and ensuring that the appliance is integrated into your overall security architecture.