07-11-2013 05:24 AM
Greetings,
Currently, we have a project underway to extend our internet redundancy. We have a pair of 5050's that have 3 Vsys at our main DC and a pair of 5050's which currently had two identical Vsys (the 3rd Vsys is irrelevant in this case and will only reside on that one pair). Here is the breakdown (some simplification happening):
Vsys 1 = Enterprise Traffic
Vsys 2 = Guest Traffic
Vsys 1
Ingress - E1
Egress - E2
Vsys 2
Ingress - E3
Egress - E4
In our redesign (due to some fiber limitations from our core to our FW) we'd like basically have the a single ingress point for both Vsys and then just some policy-based forwarding (as in, if you are coming from a specific source, you get punted to vsys2) - it's almost like a shared gateway but reversed. Since we obviously don't want to collapse the two vsys into one, we had the thought of doing an intra-chassis patch. So:
Patch E5 (assigned to vsys1) to E6 (assigned to vsys2) then, have a policy based forwarder that says anything coming from one of our guest networks is forwarded across that link thus making E6 the new ingress for vsys 2.
Does this method make sense? Any other thoughts on design?
Thanks!
07-11-2013 06:00 AM
Hi,
Seems logical, and should work. This would be one way of influencing the traffic to go out via the vsys-1 into ingress into vsys-2, because we cannot influence the traffic to go into a particular zone, if it is sourced from a subnet. Rather we can specify the egress interface for the traffic to go out from. So the PBGF rule should have the source address as the guest traffic, the destination address as any, and then the action forward and egress interface as eth1/5
BR,
Karthik
07-11-2013 06:28 AM
Thanks for the info. Is there any documentation on what the configuration from an interface / vrouter / security policy would look like? Anything documented?
07-11-2013 06:32 AM
Have you had a chance to look at the PBF tech note?
https://live.paloaltonetworks.com/docs/DOC-1562
Let me know if that helps.
BR,
Karthik
07-11-2013 06:37 AM
That was an older document. The below doc is more recent and appropriate
https://live.paloaltonetworks.com/docs/DOC-3220
BR,
Karthik
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
