Palo Alto Layer 2 bridging

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Palo Alto Layer 2 bridging

L4 Transporter

Any idea on when or if PAN is going to produce the functionality to do layer 2 bridging (example, traffic on vlan 300 would be directed to vlan 3000...etc? Right now the function only seems to be possible when in conjunction with a physical interface per bridge which isn't scalable for lots of vlans like a DC. Another option is enabling the function to bridge in vwire mode 2 different vlan tags.

7 REPLIES 7

This screen shot is missing some important details. Line 2 shows IP 172.16.15.92 sending to 172.25.10.10 and it is allowed.  Was this a successful 2 way communication? When the source and destination  networks are different, the source arps for its default gateway. 172.25.10.10 would not be the gateway unless this was a /8 mask.   I understand how this can work if all devices are on the same subnet. PAN is just modifying the tag and passing arp, and everything else to the other interface. Should that second session be blocked out to avoid confusion or am I missing something?

You must understand how it works from what I describe and please try it yourself. The second line is the rule that allows 172.16.15.92 access to 172.25.10.10. if you want 172.25.10.10 to be able to access 172.16.15.92 then you have to open access in reverse as in the third line. One more thing, even though 172.25.10.10 and 172.25.10.1 are on the same network they cannot ping each other and access service ports if they are not given permission because they are in different zones (remember this is a bridging vlan with different interfaces and zones). You have to be more careful and better understand the picture that I provide. Please do the simulation in your own lab and you will understand.

I don't think Gun-Slingers question is answered here. The bridging shown is dependent on physical interfaces, which are limited. In a situation where all traffic is moving across one Aggregate Ethernet trunk, bridging would need to take place inside the firewall. As the OP indicated, supporting a data center would not be practical using physical interfaces for bridging. Our situation is the same, and it looks like we may need to use two Aggregate Ethernet interfaces, with common VLANs between different Zones, pruning VLANs as necessary on one of the AE interfaces.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!