Protocol Protection Layer 2 or Vwire

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Protocol Protection Layer 2 or Vwire

L2 Linker

My question would it be important to add protocol protection  in Zone Protection if you are running layer 2 or vwire on you palo alto fiewalll? and if so should it be placed  on untrust or trust or both?


Cyber Elite
Cyber Elite


So the short answer is it depends on your environment and policies. Here are my thoughts:


Protect as much as possible without compromising security or performance. I have a VWire that is protecting another device and I do have threat protection on it. This way the PAN can block/stop the traffic so the vwire device doesnt get hit with it. For me everything inbound gets this treatment, i.e. the border. Outbound traffic is a different story, some I do and some I dont. It protects not only me if a host is potentially compromised but also others so my potentially compromised host doesnt attack someone else.


I hope that makes sense.



Thanks for the reply food for thought.

  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!