Relevant Zone for an IP address in Vwire

[nsrini1991]

Hi Experts,

Could you please suggest how to find Relevant Zone for an IP addresses in V Wire mode.  When configuring security policy, we need to mention the source and destination zone.

 We've PA firewalls only configured in Vwire with multiple zones.

 Please suggest is there any way we could check it from GUI or from CLI an relevant zone for an IP address.

[OtakarKlier]

Hello,

Would you be able to clarify/expand on what is meant by 'relevant zone for an IP address'.

Regards,

[nsrini1991]

Hi Klier,

 When confuring access rules we'll be specifying the zones for the source and destination addresses. In L3 mode, we'll find the appopriate zones by looking at the Routing table. 

Since Vwire acts  as bump in the wire (L2) and no routing table is populated, not sure how to calcuate the zones for the source and destination addresses.

Could you please assist.

[BPry]

@nsrini1991,

I guess generally most people would just know this information without having to look it up. You could put the IPs in as a comment on the associated interface; or you could set them up in the User-ID 'Included Networks' for that zone. 

[OtakarKlier]

Hello,

I have always used a special zone for vwires, that way since traffic is flowing 'between' zones, I can create policies around it to allow/block specific traffic, etc. Here is a guide that may help out.

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/networking/virtual-wire-deployments

I usually use vwires for external devices, say video conference equipment. Then I create zones for the vwire, vwire-external and vwire-internal. Then just create your policies on source and/or desitnation zones.

Hope that helps.