Palo FW setup site to site

[Qui]

Hi All,

We have a HA fw 3220 in our environment and our partner want to access some of our resources. They propose a PA-440 fw +  small 12-port-Cisco 3560 in between the two sites by dark fiber.

Just wonder if you can setup FWs back to back instead of having a switch in between ie a extra point of failure?

is the Gateway going to be the switch or the FW440 behind it?

Any suggestion are much appreciated.

Thanks

QL

[Qui]

HI JANARTHANAN,



Does it mean we need to have ACL on the 12 port switch ?

Because we only want them to access certain resources.

Thanks

Q

[JANARTHANAN1392 · Accepted solution]

You can control the access in your end Firewall 3220. 

Your partner network have dedicated fiber line till your network right. Then just create a VLAN in PA3220 assign it to security zone for ACL rule creation and extend it to your partner network switch.