multiple VLANs on one security zone - possible?

[_slv_]

Hi

I need your help with one (probably simple for You problem).

I have PA200 but I have only one "free" security zone and one phisical interfece free.

I need to create 4 local networks (as a subinterfaces/VLAN) that every one has their own adresses, dhcp server, NAT policy to their own IP.

Intervlan traffic shouldn't be allowed.

Is it possible? Until now I do always one security zone per one network ...

With regards

Slawek

[_slv_]

admin@PA-200> show routing route

VIRTUAL ROUTER: rtr_ign (id 3)

  ==========

destination                                 nexthop                                 metric flags      age   interface          next-AS

0.0.0.0/0                                   XXX.XXX.XXX.XXX                           10     A S              ethernet1/1

[..........]

192.168.3.0/24                              192.168.3.1                             0      A C              ethernet1/3.250

192.168.3.1/32                              0.0.0.0                                 0      A H

192.168.210.0/24                            192.168.210.1                           0      A C              ethernet1/3.1

192.168.210.1/32                            0.0.0.0                                 0      A H

192.168.230.0/24                            192.168.230.1                           0      A C              ethernet1/3.2

192.168.230.1/32                            0.0.0.0                                 0      A H

192.168.240.0/24                            192.168.240.1                           0      A C              ethernet1/3.3

192.168.240.1/32                            0.0.0.0                                 0      A H

>Can  try to include the Interface in the Source NAT rule instead of the translated address.

I dont understnd correctly - I think

I change to:

But i still can't ping from 192.168.3.x to 8.8.8.8

[_slv_]

Finally I found my mistake ...

After I add "/0" I can reach internet from every LAN (even CP is working too).

So I have to isolate traffic of every network - please give me advice hot to do that.

I wouldn't create a lot of policies like:

192.168.3.0/24 to 192.168.210.0/24 deny

192.168.3.0/24 to 192.168.230.0/24 deny

192.168.3.0/24 to 192.168.240.0/24 deny

and again

192.168.210.0/24 to 192.168.30.0/24 deny

.

.

.

.

.

Is it possible to do it in other way?

Regards

Slawek

[craymond]

If you are really trying to isolate the traffic from each subnet, you should really be creating separate zones for each one. You would just add the new zones to the outbound NAT rule and NAT policy.

[_slv_]

I know ... but  I have PA200 and I have only one security zone free ... so I have to make configuration as good as possible in this situation.

This 4 networks will have couple computers, but must be separataed.

Regards

Slawek

[craymond]

Sorry - I forgot the limitation on a 200 is 10 Zones. Unless you want to move the vlans to a layer 3 switch and use ACLs or don't enable forwarding, I think the only viable alternative would be to create the deny policies on the PAN.