VWire configuration testing

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
Not applicable

VWire configuration testing

Hi,

At a recent PA training, the instructor mentioned a testing method for testing the configuration of VWire objects and the traffic flow, as configured in your Security Policy.  The goal of this method is the ability to do testing in a lab environment vs. testing your traffic flow after you've put the device into production.

With your device in a lab environment and the VWire objects and interfaces configured, you connect ethernet to two ports you're testing.  To that you connect two switches and one laptop to either swtich (two laptops total).  You then set each laptop's gateway to the other laptop and see if you can connect.

By reaching the laptop over the other port, you're able to determine that your security policy between those two zones is configured as needed.  And you repeat this for your other ports/zones to test inter-zone traffic.

Is anyone able to confirm this method or offer a suggestion on testing VWires object / zone / Security Policy configurations prior to deploying the PA into production?  Thanks

Highlighted
L5 Sessionator

Thats an easy test to begin with. But you will only be able to test minimal traffic between the 2 laptops. The real load test would be when you pass pre-production traffic, with the PANFW, inline with the netwok ( before you replace your existing firewall with the PANFW ), without disturbing your existing layer 3 setup.

------------ internal networl---------- inside vwire inter-------------PANW----------outside vwire interface -------------router/firewall---------internet cloud

The PANFW will act as an IPS, process the traffic, matching for the applications and looking for threats.

BR,

karthik

Highlighted
Not applicable

Right, it's a very basic initial test with the goal being sure that your Security Policy allows all your inter-zone traffic.  I'm hoping to get details from others that have tested VWire configurations in a lab environment, without having to generate traffic from different networks to test the Source<->Destination allows in the Security Policy.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!