VRRP on routers connected to Palo Alto Firewalls

cancel
Showing results for 
Search instead for 
Did you mean: 

VRRP on routers connected to Palo Alto Firewalls

L0 Member

I have 2 Palo Alto Firewalls each connecting to Peplink Balance 310x routers. HA is configured between the two Balance 310x routers. What I am trying to achieve is communication between these 2 routers via the 2 FWs. The HA (VRRP) interface is in the untagged VLAN on the router. It is Layer 2 between the routers and FW's. I have the FW interfaces with an untagged interface ready to pass this traffic between them but this is not working. 

nickvardy76_0-1625050522210.png

See quick drawing above. I need to be able to pass the VRRP packets from the Peplink Balances via the 2 Palo Alto FW's. Is this possible using this design? I do not see any untagged traffic traversing the Palo's.

2 REPLIES 2

L3 Networker

Please see the articles below as palo alto can be anabled to accept untagged traffic and Vlan 0 is considered untagged:

 

 

For vwire:

 

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/configure-interfaces/virtual-wi...

 

 

For layer 3:

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClE2CAK

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClYMCA0

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClMFCA0

 

 

 

If you want interface layer 2 communication (not vwire) between the firewalls you may need to check if you can tag the native vlan on the routers before being send to palo alto:

 

https://live.paloaltonetworks.com/t5/general-topics/native-vlan-for-trunk-ports/td-p/251564

L2 Linker

Hi,

 

I have already deployed (many times) such kind (almost) of configuration (PA L3 mode + Pelink in front in our case) but we uses a L2 switch (two in fact to provide HA) between the external interface of the PA and internal interface of the Peplink... If you use L2 mode (VWIRE) on PA interface,  just be careful with Spanning-Tree.. 

 

Regards,

 

HA

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!