Protocol Protection Layer 2 or Vwire

[AndyYerger]

My question would it be important to add protocol protection  in Zone Protection if you are running layer 2 or vwire on you palo alto fiewalll? and if so should it be placed  on untrust or trust or both?

[OtakarKlier]

Hello,

So the short answer is it depends on your environment and policies. Here are my thoughts:

Protect as much as possible without compromising security or performance. I have a VWire that is protecting another device and I do have threat protection on it. This way the PAN can block/stop the traffic so the vwire device doesnt get hit with it. For me everything inbound gets this treatment, i.e. the border. Outbound traffic is a different story, some I do and some I dont. It protects not only me if a host is potentially compromised but also others so my potentially compromised host doesnt attack someone else.

I hope that makes sense.

Regards,

[AndyYerger]

Thanks for the reply food for thought.