vm palo question on interfaces for esxi

Showing results for 
Show  only  | Search instead for 
Did you mean: 

vm palo question on interfaces for esxi

L2 Linker

We have an exisiting vmware esxi environment that has 3 hosts with distributed switches configured.


Currently, each esxi host has 4 links (all trunks) going to the physical uplink switch.


We've installed a VM palo series firewall and have established managment connectivity to it via eth1/0 with no issues. 


Now we are configuring sub interfaces on the vm palo and will point the vm's to it as their gateways.  I think this part is working. 


Where our issue is happening is on the uplink from the vm palo to the physical switch.  I'm confused how this works as all the uplinks are trunks and I need to have the connection from the physical switch to the palo vm as a L3 link.


Could someone break this down for me?  Does the questione even make sense?


More info

I have a SVI on the physical Cisco switch.

I configured eth1/1 on the vm palo as a L3 link as


I have sub interfaces (vlan 80) and (vlan90) created off of eth1/2 of the VM Palo and they will be gateways for the virtual machines. 

The palo virtual router is set with a default router of to the physical switch.


Honestly without any routing, I would think that I should be able to ping from the physical switch to the as it should be directly connected but that's not working even with the management profile applied.  


So confused!  



Thanks in advance!! 


L2 Linker

I'm wondering if anyone has ever done a setup like this?  Does it even make sense?  🙂 


License shouldn’t be the issue here.


Hi @geewiss ,


If any of the palo alto interface is configured as a L3 sub-interface, then you need to configure neighboring device interface as a trunk then you can flow specific vlan traffic via that trunk port. If Palo Alto interface is configured as normal L3 interface then keeping neighboring device interface in access port should work.


L2 Linker



The key here was to make all 4 physical links from the ESXi host to the physical switch as trunks.  Then to have the e1/1 interface on the palo configured in a port group that is "vlan trunking".  Then to have a sub interface on the palo with tagging the vlan number.  This seem to work.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!