VWire

[snormoyle]

I have configure a 2050 in a vwire configuration can I still utilize layer3 on the device.  From what I have been reading if I configure PAN device for vwire then the device cannot due any layer3 funcationality.

[mikand]

You can setup L3 on the other interfaces (which are not part of the vwire configuration) if you wish?

But in theory I think it should be possible - I mean vwire isnt directly magical (even if it might feel like magic 😉

I would like to say that vwire is similar to how you can setup a cisco switch with a SVI (Switch Virtual Interface):

interface FastEthernet1

switchport access vlan 123

switchport mode access

switchport nonegotiate

!

interface FastEthernet2

switchport access vlan 123

switchport mode access

switchport nonegotiate

!

interface Vlan123

ip address 10.0.0.1 255.255.255.0

In the above case stuff that enters FE1 will most likely pop out at FE2 and the other way around - however if the packet arriving to either FE1 or FE2 have dstip=10.0.0.1 then the switch itself will respond.

[snormoyle]

The "design" documentation states as a vwire disadvantage "cannot perform any layer 3 functionality on the device, such at NAT or routing" with a side note that starting in PAN OS 4.1 NAT is possible in a vwire configuration.  I have been trying to get layer3 to work on a PA200 with no success.  Ports 1 and 2 are in the vwire, so trying to get ports 3 and 4 to work, but after configuring the ports for L3 and creating a route the devices connected to ports 3 and 4 cannot get out to the internet.