VLAN's with Palo Alto - Primer/Tutorial?

[networkadmin]

One of our switches has a couple of untagged connections into our PAN.

Each connection is configured on the PAN as a regular L3 interface with an IP address assigned and the interface is in the appropriate zone.

I'm interested in reclaiming one of the NICs on the PAN so it would be nice to be able to run a trunk from the switch to the PAN.

Where I'm struggling a little is in making sense of the Admin Guide on how I do this - specifically how I tell the PAN that I have VLAN20 and VLAN30 coming into it, and I want to assign the PAN 192.168.1.254 on VLAN20 and .2.254 on VLAN30 and have the VLAN interfaces assigned to the zones that the L3 interfaces were in (as at this point I wouldn't be using those two L3 interfaces).

I'm sure my terminology is a bit off for which I apologise, but hopefully I've explained what I'm looking to do - are there any example white papers or tutorials please?

If there's any questions just ask.

Thanks.

[rmonvon]

Hi...Please review Case 1 in this 'Securing Inter VLAN traffic' doc.  It has the configuration for multiple VLANs on one port.

https://live.paloaltonetworks.com/docs/DOC-1618

Thanks.

[networkadmin]

rmonvon wrote:
Hi...Please review Case 1 in this 'Securing Inter VLAN traffic' doc.  It has the configuration for multiple VLANs on one port.
https://live.paloaltonetworks.com/docs/DOC-1618
Thanks.

That looks absolutely spot on thank you.

So in that scenario (Case 1) I wouldn't have any data going into the Palo Alto untagged on that interface, it would be a pure trunk port?

Presumably on the Palo Alto I would only need to create sub-interfaces for any VLANs that I wanted the Palo Alto to handle and anything else on that trunk would just be ignored by the PAN?

It looks like a 5 minute thing (plus changing the uplink from the switch from an access port to a trunk) so I'm suspicious as I assumed it would be more complicated than that?

[bentech]

i hadnt seen any documentation on this so i configured it a bit different - i configured a layer 2 interface with a layer 2 subinterface for each vlan - int 1/6 - 1/6.10 1/6.20 etc, than i created vlans and layer 3 vlan interfaces - everything seems to be working - any idea if theres a downside to keeping it this way?

[rmonvon]

Either method will work.  Thanks.