VLAN Confusion

[bgre033]

Hi,

I’ve recently got a PA-440, and trying to make sense of the VLAN logic on PAN-OS has got me stumped.

First of all, I get creating a layer 3 sub interface and assigning a VLAN tag, easy. A bit odd that the 'tag' doesn't then show up as a VLAN under Network > VLANs, but I can let that slide.

It's an access port where things really don't make sense. I follow the steps below, and even though it works it just doesn't make sense.

1. Mark an interface as layer 2, and assign a layer 2 zone to it, ok.
2. Create a VLAN (Network > VLANs) - sure, but you don’t specify a VLAN ID, just a name. What is the point of this construct?
3. Assign created VLAN (from step 2) to the physical layer 2 interface - again, ok, but given the VLAN hasn’t got an ID, does this achieve anything?
4. Create a VLAN Interface (with an ID between 1-9999) and assign a VLAN to it. I assume this is like an SVI, but I don’t need a layer 3 VLAN interface, why is this necessary? Also, it seems like the ID is meant to be the VLAN tag (but the range is not right, 1-9999 rather than 1-4094)?

I'm hoping someone can explain this to be, as the documentation isn't clear.

1. What is the point of VLANs under Network > VLANs? Given you don't specify a VLAN ID.
2. Is the ID under the VLAN interface actually a VLAN tag, rather than an interface ID? If so, why is the range 1-9999 (rather than 1-4094)?

Thanks for any help.

[seb_rupik · Accepted solution]

Hi there,

Palo Alto have taken the approach of decoupling the VLAN ID from the VLAN virtual-bridge construct. When you create a VLAN object under Network -> VLAN, the name is the UID not a VLAN ID as would be the case on a cisco. The object you create here is a virtual-bridge which is used to bind the various Layer 2 interfaces defined Network -> Interfaces -> Ethernet and a single SVI under Network -> Interfaces -> VLAN.

The ID number which is required by a sub-interface or VLAN/SVI interface is arbitrary. The tag number which is selected under the sub-interface is the VLAN ID and is used for the 802.1Q encapsulation. The sub-interface ID and tag number do not have to match, but it can help with readability!

It is worth noting that this decoupling of VLAN ID from the VLAN object means that sub-interfaces which use different 802.1Q tags can use the same VLAN virtual-bridge effectively performing VLAN tag rewriting.

cheers,

Seb.

[bgre033]

Thanks, Seb.

This would suggest that an access port cannot exist (for example) in VLAN 20 unless a sub-interface has been created with tag '20' and both of these objects have been associated with a VLAN object (Network > VLAN)? Suppose this doesn't really matter, as an access port VLAN ID isn't relevant unless a trunk port exists somewhere on the said device (which it won't unless sub-interfaces have been created).

Finally, I take it a VLAN sub-interface (Network > Interfaces > VLAN) isn't needed unless inter-VLAN routing is required?

[Raido_Rattameister]

It is always easier to set interfaces in Layer3.

Main interface will be untagged and subinterfaces will tag packets.

Layer2 makes sense only if you deploy firewall in small office with few devices and you don't have dedicated switch (all devices connect directly to Palo) and you need multiple interfaces to be in same subnet/vlan.

Other reason to use Layer2 is if you have existing setup. Let's say web server and database servers were historically deployed in single vlan. You want to separate them and place firewall in between. What you can do is connect web server and database server directly to Palo. Set Palo interfaces in Layer2 and create firewall policy in between to permit only specific traffic. As a result no re-IP needed but security posture improved.

In all other cases Layer3 with subinterfaces is way to go.

[seb_rupik]

Hi there,

Once you configure a Layer2 sub-interface you are creating a trunk link and 802.1q will be enabled, using the 'tag' value as the VLAN ID on the encapsulated frame. 

An access port if you think about doesn't really need a VLAN tag, as it is never imposed on the frame, they arrive and leave untagged.  The VLAN tag/ ID is there purely to identify which virtual-bridge the frames belong to.

The object created under Network -> Interfaces -> VLAN is not a subinterface. I see you confusion as it prepends a digit to the interface name. The interface here is a SVI/ IRB . If you have configured your firewall interfaces all as Layer2, then yes you will need these for inter-VLAN routing. You can have a mix of routed Layer 3 interfaces (dedicated or subinterface) and VLAN interfaces for inter-VLAN routing, depending on your topology.

cheers,

Seb.

[bgre033]

@seb_rupik @Raido_Rattameister Thanks for your responses, I appreciate it.

[Raido_Rattameister]

Once you get to v11 one day you can configure PPPoE on subinterface.

[bgre033]

Ah, nice, I've been waiting for this. How stable is v11? 🙂

[Raido_Rattameister]

I have few test installs and they run smooth and stable. They don't have too complex config though.

Have not found any new bugs.

Old ones that have been issues also in 10.2 are still present. Mostly reporting related like CSV export still puts annoying b' ' characters around values in 11.0.1

SaaS report print as PDF still puts gray frame around edges in 11.0.1

If config is pushed from Panorama then you can't use firewall built in UserID agent with 11.0.1. Got fix in 10.2.4 but v11 will get its fix with 11.0.2

Management plane cpu went up a bit with 10.2 > 11.0.0. Have not checked 11.0.1 yet.