Using PA220 as a "switch"

[holten]

Hey all, i got a question that im not sure how to solve.

This is my setup/what i want to do do.

I got a L3 internet line on Ethernet1

On eth2 i got a CAT2960L with vlans 10 and 20.

On eth3 i got a CAT2960L with vlans 10 and 20.

I got 2 2802i with mobility express and i want to use one as a WLC and the other to use that WLC.

One AP will be in VLAN 10 and one in VLAN 20.

I also want the vlans to be able to communicate with eachother, but still be different zones because of different

internet rules ect.

Is it possible for me to use the PA220 eth2 and 3 as "switch ports" and use the PA220 as router/DHCP server?

If so, how is that done? Iv tried with sub-interfaces, but i cant seem to get inter vlan routing to work. Even if i override

Intrazone fw rule. Iv created vlans 10 and 20 on the PA220, iv also set it up as a L2 interface, but that doesnt seem to work either. I seem to get issues with my viritual router, L2 and L3 doesnt mix, i understand why, but i dont know how to get around it.

ANy suggestions are welcome! Im sure some of you guys have done similar stuff before.

Best regards, Marius

[CMachado · Accepted solution]

Hi!

Regarding inter-VLAN routing: if you do need a routable path between the VLANs, then work with layer 3 subinterfaces instead of layer 2. This way, you can use VLAN tag and/or IP qualifier to assign traffic to your subinterfaces (not main interfaces; you can't >>> Unable to Add VLAN Tag to Layer-3 Interface) and select a Virtual Router for them to communicate, all while keeping them in the same or different zones. If the zone is different, then aside from the route in the VR you'd need the proper Security Policy rule in order for the traffic to pass from one zone to another.

Quick guide on this: Getting Started: Layer 3 Subinterfaces

I don't currently have any experience on your other requirements as to help you :'D

[holten]

So, it would like somewhat like this then:

Eth1 Internet

I need both these vlans on both switches. 

Eth 2.10 ADMIN

Eth2.20 Datacenter

Eth3.10 ADMIN

Eth3.20 Datacenter

 How can i i solve the DHCP, i cant put one scope on more then one sub-interface, i dont see how this can work.

Best regards, Marius

[holten]

I solved it with L3 - subinterfaces and another switch 2960L switch.

So im trunking 2 switches into one and trunking that one into L3 interface with subinterfaces. Works perfectly.

Thnx for the feedback.

Marius

[CMachado]

Good to hear!

Sorry I didn't get back to you sooner, but I got caught up with work.