Virtual Wire DMZ - Help Please
cancel
Showing results for 
Search instead for 
Did you mean: 

Virtual Wire DMZ - Help Please

L4 Transporter

Hoping for some clarification on using Virtual Wire to inspect traffic to our DMZ please.

Right now the external interface of our PAN has a public IP of 1.2.3.1/24.

Its default gateway is another firewall in front of it, it's internal interface has a public IP of 1.2.3.2/24.

Both of these interfaces are connected to a switch, and on that switch we also have a webserver/mail relay which have public IP's on the same 1.2.3.0/24 network, kind of like this:

LAN

|

|

PAN (external interface is in dumb switch)

|

Dumb Switch--DMZ Servers

|

Perimeter Firewall (internal interface is in dumb switch)

|

Router

I know I can bring those DMZ servers in behind another interface on the PAN and assign them private IP addresses and have the PAN do the decryption/inspection/forwarding.

I also believe I can setup a DMZ "virtual wire" which will let me do SSL decryption and threat/virus inspection without having to touch the configuration on any of those DMZ servers.

What I'm not clear on is how I'd do this, and as I don't have a PAN I can test on I'd appreciate some clarification before I do anything.

Equally if every "best practise" out there is to do this using traditional NAT tell me and I'll look at doing it this way (How do I best build up the "new" ruleset on the PAN without committing it until I'm ready, whilst being able to make changes to my running config if I need to?).

Thanks.

2 REPLIES 2

L5 Sessionator

You probably want to check with your SE or Reseller regarding your network architecture, but there is another option that may work for you; a Layer2 to Layer 3 connection.  Documentation can be found at the following link:

https://live.paloaltonetworks.com/docs/DOC-1067

Thanks for the reply.  I had a chat with Vadition and they were of the view that the simplest solution (maybe more work to get there but neater/simpler) would be to bring the hosts off a L3 interface and have a DMZ zone and do inbound NAT etc.

One question on that as I only just asked them - can you assign multiple NICs in the PAN to the same L3 interface?

I ask as we only have two DMZ hosts so it'd be nice to be able to plug them directly into the PAN vs. bringing another (small) switch into the equation.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!