About Tician

Hi All, I have couple question in mind when I’m think about implementation PAN firewalls in Data center design. In reviewing design guide “Designing Networks with Palo Alto Networks Firewalls”, mostly where described perimeter firewall with upstream untrusted networks, exceptionally where we got hierarchical design with trunks between aggregation and core. But in most used scenarios by this guide, I cannot find such scenario, where is implemented aggregation and core in one layer. Example: One customer has two L2/L3 switches with implemented VRRP, which is access, aggregation and core in same time.  Clients, servers and others, are divided into VLAN’s and they are terminated on L3 within same switches. Questions: In such design, is there possible to implement PAN and secure communication between VLAN’s, or redesign is needed? If such design is supported, can you provide some configuration example?   Thanks, SBS ... View more

Hi, does anyone have VM series configured like L2 firewall (intra-host communication) and well working? My interface ethernet1/4 is configured like L2 and have leg to portgroup (vlan xx) glued to zone abcd.... Polices was created in way to deny SSH between zones abcd to abcd and allow other traffic, but SSH pass anyway from one guest vm to another in abcd zone. Situation is same with other deny traffic too, so I'm suspect that L2 firewall not working at all. Port group on distributed virtual switch is configured with promiscuous mode to allow, but from underlying infrastructure and VMware perspective that's mean that all traffic was redirected to all ports for monitoring purposes and cannot be filtered with "L2 interface leg" on PAN VM.  From Monitor tab, I filtered "interesting" traffic between guest VM's, and by firewall, traffic are filtered "action>deny", unfortunately that is not truth... ... View more

Hello to everyone, recently I installed new VM100 on ESXi 5.0 infrastructure, but during initial configuration I noticed that L3 subinterfaces cannot forward any traffic, even I configured virtual router and policy with permit all-any statement between two sub's (zones). On VMware side on distributed switch I created  trunk portgroup with 2 vlan's, and map third interface on VM profile (ethernet 1/2 on VM100) to that port group.  On VM100 I split eth1/2 like L3 on two subinterfaces and bound them IP addresses, vlan tags and Vrouter. MAC address for both subinterfaces is the same and inherited from parent physical Eth1/2 and that is visible on both vlan's (mac tables on external cisco switches). Explicit policy was applied to forward any traffic between this two subinterfaces but nothing are forwarded. From CLI, only I can see that passing between two subinterfaces is ping (#ping source (IP of one subint) host (IP of second subint), but that is inside routing engine.  If anyone have similar experience, please advise before I open support case..... ... View more