What is multi-vsys firewalls?

[tinhnho]

Hi guys,

What is multi-vsys firewalls?

Why do we need multi-vsys firewalls?

What are cons and pros of using multi-vsys firewalls?

Could I get some cases that needs multi-vsys firewalls?

AS of now, my panorama has default vsys is vsys1 for the templates.

Thanks.

[kiwi · Accepted solution]

Hi @tinhnho ,

Please check out this multi vsys overview where you will find benefits and use cases:

Virtual Systems Overview 

Kind regards,

-Kiwi.

[OtakarKlier]

Hello,

Basically a way to logically segment the firewall for different uses/customers, etc.

Regards,

[UrikSilva]

Hi @tinhnho 

Normally vsys is used for Service Providers which needs to split (share) a big firewall appliance in small pieces attaching different interfaces, virtual routers, administrators, objects and so on.

Hope it was helpful.

Cheers,

Urik

[tinhnho]

Thanks. If I have 2  firewalls, 5260 and 3220, for 2 customers (each customer has 2-5 staff) and they aren't busy at all, can I segment these 2 firewalls? What steps do we need to segment a firewall into a smaller logical firewall if we can?

[TomYoung · Accepted solution]

Hi @tinhnho ,

The PA-5260 supports 25 base virtual systems.  The PA-3220 supports 1.  https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-5260,pa-3220

First, you would need to purchase a vsys license for the PA-3220.  Second, you would create a new virtual system.  Third, you will create separate administrator roles for each virtual system.  Then, your customers can configure their vsys just like a regular NGFW.  Vsys1 can continue to be one of those virtual systems.  I think you will need to assign interfaces to each vsys before the customers can use them.  It has been a while.  You could go with separate physical interfaces or use trunk ports and assign different sub-interfaces to each customer.

Thanks,

Tom

[Raido_Rattameister · Accepted solution]

If each customer manages their firewall themselves then yes you need to use vsys to avoid admin of one customer to see config of other customer.

If you manage it all and customers don't have access to firewall then vsys config adds complexity.

[tinhnho]

Thanks guys, I'll be getting license for vsys

[dajeme]

Multi-vsys firewalls, also known as virtual systems, are separate, logical firewall instances within a single physical firewall device. This technology allows managed service providers and enterprises to use a single pair of firewalls (for high availability) and enable multiple virtual systems on them. Each virtual system (vsys) is an independent, separately-managed firewall with its traffic kept separate from the traffic of other virtual systems