VWIRE Physical Connecivity to Current Virtual Firewall

[indysogi]

Hi,

I am trying to get my head around VWIRE and how it supposed to work.

We have the following scenario

SWITCH -> VIRTUAL FIREWALL (ON SHARED HOST) -> INTERNET

We are now looking to do

SWITCH -> PALO ALTO -> VIRTUAL FIREWALL (ON SHARED HOST) -> INTERNET

I am thinking how this would work physically. The virtual firewall sits on a VM host (shared with other VMs) which plugs directly into the switch.  It is a flat network.  Therefore both e1/1 and 1/2 on the palo will go into the same VLAN.  How would the Palo know how to intercept the traffic with the client machines default gateway being the virtual firewall which also sits in the same VLAN and also on the same switch.  I have seen articles that e1/1 and e1/2 should be connected to the same VLAN either side be it an access or trunk port, then I have seen articles were e1/1 and e1/2 are in different VLANs.   The physical architecure iof vWIRE in terms how to cable this up is not documented anywhere really.

Some feedback would be very much appreciated.  Thanks

[reaper · Accepted solution]

to be able to 'force' traffic over the vwire, the virtual firewall will need to be on a different vlan than the clients so the switch is unable to bridge the 2 together

that or the server needs to be physically connected to one side of the vwire

[pankaku · Accepted solution]

Check the following topology.

We have made the traffic to pass through the firewall by the help of VLAN.

Note that if the port 4 and port 1 become part of same VLAN the traffic will not pass through PA firewall.