VPN & Portal on PA2020 running only Virtual Wires

[RonaldGo]

hi

Our network has 3 separate connectivity to the internet and all of them are connected via virtual wire on our PA2020 and the only other network connection is the management port on a fixed internal IP... 

total 7 ports used (3 pairs for the 3 virtual wires & 1 management).

is it possible to setup VPN & Captive portal on such a setup?

thanks!

[mikand]

I have a faint memory that PANOS 5.0 introduced the possibility to create L3-subinterfaces on vwire nic's so you then can use VPN & Captive Portal which needs a L3 interface to communicate with the client.

[RonaldGo]

thanks for this tip...  i'll look into it and see where it leads...

[mikand]

I might be confused by this entry in the release notes:

"

Virtual Wire Subinterface – You can now create virtual wire subinterfaces in order to classify traffic into different zones and virtual systems. You can classify traffic according to the VLAN tag, or VLAN tag plus IP address (IP address, IP range, or subnet).

"

However I still think it should be possible to create a L3-subinterface on a VWire setup.

Because VWire is just like a regular switch and its settings are similar to the ones you can set for a switchport regarding "allowed vlan" and such. On a switch (if we take a cisco for example) you can setup loopback interface which will act as mgmt-interface (in the switch example). Which gives if dstip=loopback_ip then send to the system cpu else switch to the other physical interface - I think the same should be possible on a PA (and if not today then by a feature request unless there is some other magic involved when using VWire?).

[cverite]

Hi

I do the same test and I didn't see to add the response page for the portal captive on the subinterface Virtuel Wire.