PANOS 10.x - share interface in Multi-vSYS mode

[psycoma1984]

Hello All,

We are working on a design to move Cisco ASAs firewalls into PA 5260 with Multi-vSys mode enabled, so each Cisco ASA is a separate vSys. 

While everything else looks like nice and easy-to-convert, we have problems with shared interface. In Cisco world multicontext ASA might have interface in same VLAN X and SUBNET Y on each context easily. 

Is it possible to do the same on Palo Alto platform? I am familiar with Shared Gateway and External Zones, but it doesn't look like it will solve our problems in full. For example we need to have 3 sub-interfaces in same subnet (one per context), is it actually possible to create those and add into single Shared Gateway?

Thanks! 

[Fabio_Cremona]

Hi,

For example we need to have 3 sub-interfaces in same subnet (one per context), is it actually possible to create those and add into single Shared Gateway?

You can configure sub-interfaces with the same IP-Address for different context but you can't have the same subinterface L2 Tag (802.1q) within the same physical interface.

[psycoma1984]

Hello Fabio,

Thanks for your reply. Do you know if that's possible to have 'untagged' physical interfaces added to different contexts within same subnet on a PA box? We can 'tag' them to the same VLAN on a switch. 

[Fabio_Cremona]

Yes, it is. You can assign different physical interfaces to different context with same ip space.

[psycoma1984]

hello Fabio,

One question more - you mentioned that "can't have the same subinterface L2 Tag (802.1q) within the same physical interface". Does it also mean that I cannot have 2 subinterfaces with same DOT1Q tag within same PORTCHANNEL interface?