Use PA-500 ports as additional access ports (switch ports)

[adam_plaid]

I was hoping to get some direction.  I have deployed a PA500 in a small office using a standard L3 deployment (one trusted (LAN) and one untrusted (WAN) interface) and need a few switch-ports on the LAN side for access points.  Is it possible to add additional interfaces to the trusted zone and use them as switch ports in the same subnet and virtual router as my current L3 trusted interface?

I found the document in the KB explaining how to connect L2 and L3 networks but I don't think that is what I need to do.

I really don't want to put a cheap 8-port switch in front of my nice firewall 🙂

[pulukas · Accepted solution]

You can create a vlan group for this purpose and replace your current L3 interface with a vlan interface.

• On the desired interfaces set them to L2 type
  under Networks->interfaces->Ethernet
• Create a vlan "inside" and put all the L2 interfaces into that vlan
  under Networks->VLANS
• Remove your L3 interface
• Create a VLAN interface and place into the trust zone and your L3 ip address.  Add the new vlan to this interface
  under Networks->Interfaces->VLANS

[hshah]

Hello Adam,

Here I have taken Example for  Ethernet1/9 as a port to be in VLAN1.

1. Delete Configuration for L3 Ethernet Port.

2. Create L3 VLAN, as mentioned bellow.

2. Change Etherenet 1/9 into Layer 2 Port.

3. Add Etherenet 1/9 into VLAN

Likewise you can add more ports to same VLAN.

Let me know if this helps.

Regards,

Hardik Shah