Protocol Protection Layer 2 or Vwire

Reply
Highlighted
L2 Linker

Protocol Protection Layer 2 or Vwire

My question would it be important to add protocol protection  in Zone Protection if you are running layer 2 or vwire on you palo alto fiewalll? and if so should it be placed  on untrust or trust or both?

Highlighted
Cyber Elite

Hello,

So the short answer is it depends on your environment and policies. Here are my thoughts:

 

Protect as much as possible without compromising security or performance. I have a VWire that is protecting another device and I do have threat protection on it. This way the PAN can block/stop the traffic so the vwire device doesnt get hit with it. For me everything inbound gets this treatment, i.e. the border. Outbound traffic is a different story, some I do and some I dont. It protects not only me if a host is potentially compromised but also others so my potentially compromised host doesnt attack someone else.

 

I hope that makes sense.

 

Regards,

Highlighted
L2 Linker

Thanks for the reply food for thought.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!