Virtual Wire DMZ - Help Please

[networkadmin]

Hoping for some clarification on using Virtual Wire to inspect traffic to our DMZ please.

Right now the external interface of our PAN has a public IP of 1.2.3.1/24.

Its default gateway is another firewall in front of it, it's internal interface has a public IP of 1.2.3.2/24.

Both of these interfaces are connected to a switch, and on that switch we also have a webserver/mail relay which have public IP's on the same 1.2.3.0/24 network, kind of like this:

LAN

|

|

PAN (external interface is in dumb switch)

|

Dumb Switch--DMZ Servers

|

Perimeter Firewall (internal interface is in dumb switch)

|

Router

I know I can bring those DMZ servers in behind another interface on the PAN and assign them private IP addresses and have the PAN do the decryption/inspection/forwarding.

I also believe I can setup a DMZ "virtual wire" which will let me do SSL decryption and threat/virus inspection without having to touch the configuration on any of those DMZ servers.

What I'm not clear on is how I'd do this, and as I don't have a PAN I can test on I'd appreciate some clarification before I do anything.

Equally if every "best practise" out there is to do this using traditional NAT tell me and I'll look at doing it this way (How do I best build up the "new" ruleset on the PAN without committing it until I'm ready, whilst being able to make changes to my running config if I need to?).

Thanks.

[nrice]

You probably want to check with your SE or Reseller regarding your network architecture, but there is another option that may work for you; a Layer2 to Layer 3 connection.  Documentation can be found at the following link:

https://live.paloaltonetworks.com/docs/DOC-1067

[networkadmin]

Thanks for the reply.  I had a chat with Vadition and they were of the view that the simplest solution (maybe more work to get there but neater/simpler) would be to bring the hosts off a L3 interface and have a DMZ zone and do inbound NAT etc.

One question on that as I only just asked them - can you assign multiple NICs in the PAN to the same L3 interface?

I ask as we only have two DMZ hosts so it'd be nice to be able to plug them directly into the PAN vs. bringing another (small) switch into the equation.