Flat Network across PA-415

[jatin_2023]

Hello All,

I have spent ages and days and a few weeks setting up a PA-415 to work with a group of LAN ports into one network set into a VLAN configuration using the on-board DHCP server. One of the engineers in this forum assisted me extensively and helped me build the settings. I found this idea/solution in this community and the only way to group several LAN ports. I have a layer 3 on the WAN and layer 2 VLAN ID set to 4 ports on the LAN.

Today on the support website at palo alto, one of the recommendations outputted was configuration on layer 3 with no VLAN. So that got me thinking, can i configure a straight layer 3 networks on the wan side and a layer 3 network on the LAN side in a flat network with no need for vlans or segration so all ports 1 to 9 are all on the same subnet.

What do you think and is the simplest configuration?

From Jatin

#firewall

[TomYoung · Accepted solution]

Hi @jatin_2023 ,

You cannot configured multiple L3 ports in the same subnet on the PA NGFW.  This is a limitation by design on all routers.  It can lead to multiple problems.

I have configured your original design, and it works fine.

1. Put port 1 in a L3 outside zone.
2. Create a VLAN for your inside interfaces.
3. Put ports 2-9 in a L2 inside zone and assign them to your VLAN.
4. Created a VLAN interface for the VLAN assigned to ports 2-9.  Put the VLAN interface in a L3 inside zone.
5. Create a DHCP server attached to your L3 VLAN interface.
6. Use the L3 zones for your policies.

Thanks,

Tom

[jatin_2023]

Sorry for the late reply Tom I have been on holiday most of last week and for a few days. Thank you Tom for the confirmation and the clear technical answer to my question. Most appreciated of your time.