PVLAN

[Kenya5115]

Hello. I've been trying to use PVLAN with palo alto. I have two isolated host which are on the same subnet and wanted them to communicate through palo alto. I was able to manage with a switch using local proxy arp but from what I've searched palo alto doesn't have that feature.

I see the arp packets from host A going to palo alto but since the destination isn't palo alto and there isn't a proxy arp feature I believe palo alto drops them even before reaching the dataplane. 

Has anyone successfully managed using PVLAN with pal alto? 

Thank you for the help. 

[BPry]

@Kenya5115,

This functionality wouldn't be backed into PAN-OS at all. There's ways that you can get this to function by just segmenting everything via multiple gateways assigned to the same zone and setting and overriding the intrazone-default policy behavior with a dedicated rule or just by changing that policy form allow to deny, but there's not a magic way to get this to function and without a good handle on automation such a deployment could be a major inconvenience to the rest of your infrastructure team.

[TomYoung]

Hi @Kenya5115 ,

You can have the NGFW inspect traffic between L2 hosts without having to route them via proxy ARP.  You can connect them to L2 ports and add them to L2 zones.  Then the security policy can be used to control traffic between the 2 hosts.  You would create a VLAN interface to route traffic to different subnets.  You could even migrate your current L3 interface to L2, but you would need to add a 2nd L2 connection for one of your hosts (either directly or though the switch on a new VLAN).

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRq

https://live.paloaltonetworks.com/t5/general-topics/security-policy-between-layer-2-zones/td-p/30293...

Thanks,

Tom