Palo Alto in Cisco network with VRF lite

[oshcomp]

BRosenba asked this question last year.  "We've recently purchased an HA pair of PA 5050s. We are planning to utilize the devices in cooperation with some Cisco core switching hardware and VRF lite to segment/secure internal traffic as well as traffic to the Internet."

Is there a layer 3 solution with the Palo Alto?  The Cisco core switch has two routing tables and one physical connection to the PA.  Is it possible for two internal addresses each in a different routing table to communicate using the PA as the intervening firewall?

Thanks,

Ann

[mikand]

There are various setups described in these docs which I guess might be helpful in your case:

Designing Networks with Palo Alto Networks Firewalls

https://live.paloaltonetworks.com/docs/DOC-2561

Diagrams and Tested Configurations

https://live.paloaltonetworks.com/docs/DOC-2560

Even if PA will work as "router on a stick" you will get better performance throughput if you utilize more than one cable for all your traffic (like a physical interface as inside and another as outside).

If im not mistaken QoS doesnt work on aggregated interfaces today (I think this is already setup to be fixed in future releases) but this is only good to know if you will use QoS in your PA (otherwise you can let the routers do the QoS for you).

You can also setup VSYS in PA to virtually split the dataplane for various uses (given that you trust stuff such as VRF and VSYS etc).

When it comes to performance - instead of using your two PA's in a active/passive cluster (or active/active for asymmetric routing (note that the total performance is still the same of active/passive) you can configure them as two independent boxes and use panorama to make the configuration easier for the administrator. This way the routers can perform ECMP (Equal Cost MultiPath) to loadbalance between the two independent PA's (and make sure to use hash(srcip+dstip) as loadbalance algo) and by that you will get twice the performance through your PA "cluster".