Vwire inbetween Cisco Asr router and Nexus 9K Switch

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Vwire inbetween Cisco Asr router and Nexus 9K Switch

L3 Networker

I am having trouble with the following. 


Cisco ASR router with IP of plugs into Cisco 9K switch into port eth 1/3, eth 1/3 is configured the follwoing way.


interface TenGigabitEthernet0/0/1
 description LAS-9K-2
 ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nbar protocol-discovery
 load-interval 30
 cdp enable

interface Ethernet1/3
switchport access vlan 852
no shutdown


The Palo is configured as follows.


L3-9K2-vwire        ethernet1/19      ethernet1/20      p       0-4094

Palo port 19 connected to 9K eth 1/15

interface Ethernet1/15
  switchport access vlan 852
  no shutdown

Palo port 20 Connected to 9k eth 1/16

interface Ethernet1/16
  description Palo-Wan2-eth20
  no switchport
  speed 10000
  no ip redirects
  ip address
  no ip ospf passive-interface
  ip router ospf 1 area


The IP's above have been changed for this discussion.   What is happening there is no traffic from the layer2 vlan 852 on the cisco switch.  In the palo traffic logs i can see trying ping, but never 10.1.15 to 10.1.16


I am not sure what i am missing, I have done this before.


Cyber Elite
Cyber Elite


Do you have security policies on the vwire allowing traffic in both directions? Check the traffic logs for any drops or denies in either direction.



By default virtual wire permits through only untagged packets.

Did you add 0-4094 (or you can be more specific to allow only vlans you want) into virtual wire Tag Allowed box?

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

The Policy rule is set for any any, with application default set to any.  



The vwire is set to 0-4094 for tagging.  

  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!