PA Zones

[RC-BHF]

I have several subnet routed through the PA for Internet Access. All the subnets are conencted via the same NIC.

I wanted to seperate the one of the subnet into a PA zone , but since it is connected to one NIC I cannot have two zones on the same NIC. Is this corerct ?

[cpainchaud]

1 zone per logical interface so 1 NIC can have several subi-interfaces which are in different zones

[pankaku]

I have created two subinterface of 1/3 now I can assign different zone to different subinterfaces. The physical interface will be part of native vlan and I have assigend tag 2 to 1/3.1 so it will be part of vlan 2 similarly  1/3.2 as part of vlan 3

[RC-BHF]

Thank you both for the helpfull reply.

I would like to assign one of the subnets into a diffrent zones, would like to do it without having to set up VLANs etc, I have attached a diagram.

I would like the second subnet to be a diffrent zone in PA, but I am struggling to undertand I this can be done.

The Interface into the PA is just a Layer 3 with an IP. The routers Default GW is the PA.

Applogies, if this a basic question,  I am PA newbie.

[cpainchaud · Accepted solution]

from your diagram you can't because the PA sees both network on same logical interfaces.

you may want to remove that router and put the PAN device instead

[reaper]

Hi

You could use untagged subinterfaces,which allows the firewall to apply a different zone per configured subnet

This eliminates the need for VLAN tags:

How to Configure L3 Untagged Subinterfaces to Communicate within Different Zones

regards

Tom

[cpainchaud]

in his case he has an intermediate router , can't work. In addition it's all but secure to have both in same vlan ...