multi lan multi wan best practice

[paloaltouser2020]

situation is this :

currently i have :

multiple lans/vlans

1 p2p line (single subnet static route0

1 internet line

1 virtual router

now, i need to add another wan

my best practice should be

a : to do another virtual router and separate relevant networks to each vr?

b : to "bag" everything under 1 vr with ecmp enabled + pbf?

c : maybe something i didn't think about?

in general, what are the advantages/disadvantages of using a single vr in such a case, as opposed to multiple vr?

because using a multiple vr seems like a whole lot of work "teaching" the vr's to the entire routing table of the opposite vr, but maybe i'm wrong...

thank you

[SutareMayur · Accepted solution]

@paloaltouser2020,

Having multiple VRs would be the great choice when you have separate requirements all together, e.g. you want to have separate routing paths and those shouldn't shared between VRs etc. So choosing option among all available depends on the requirements and how are you going to manage it.

Looking at your use case and requirement, with single VR and ECMP should be the good option here. Also it will be very easy for you to manage it. I personally using same configuration on my several branch firewalls.

With multiple VRs, if you want to route traffic between the VRs, you need to have routes on respective VRs pointing to next hop as the destination VR where you want to reach. So you need to manage these things with multiple VRs. Having said that I would also say there are no as such major drawbacks of having any of the configuration (single or multiple VRs) as each has its own requirements and use cases.

[paloaltouser2020]

thank you so much for the detailed reply 🙂

in response to that : "each has its own requirements and use cases"

what are use cases where i'd want to use multiple vr's?

[SutareMayur]

Hi @paloaltouser2020 ,

Multiple VRs can configured,

1. To have separate routing paths for different traffic. And you want to keep routes isolated between VRs
2. You may have heard about Cisco VRFs which is licensed based and comparatively these licenses are expensive. Now imagine PaloAlto multiple VRs here.
3. Lets say you have Customer, Corporate and guest zones on single firewall and you want to use different routing for each zone.

In such and similar other cases, multi VRs would be helpful.

[paloaltouser2020]

cool. many thanks