I think the setup will be easier to understand if you split up the "functions" (and perhaps use different naming): 1) External <-> "IPS" <-> TMG 2) External <-> "FW" <-> Internal But instead of using two different boxes you will just use one (well or a failover pair). You could also segment the dataplanes by using VSYS if you prefer. When in VWIRE the PA will (for the particular interfaces) function just like when you use an IPS - transparent for the surrounding equipment. But compared to an IPS the PA will be a full blown firewall (which includes IPS capabilities). Full blown firewall in terms of being able to filter the traffic not only on ip/port but also application along with SSL-termination and such. Another way to describe this would be when using VWIRE the box "is not there". So in your case one could describe the setup as: 1) External <-> TMG 2) External <-> FW <-> Internal Meaning that the TMG will not see the PA at all, just as if the TMG box would sit directly on the external switch/router. Regarding the VLAN interfaces its just how I prefer to define stuff, of course you wont need a particular VLAN interface on the PA - a L3 interface will be just fine. So to clean it up 😉 int1: vwire-int zone vwire_tmg int2: vwire-int zone vwire_external int3: L3-int 10.x.x.x zone internal int4: L3-int 156.98.x.x zone external or if using VSYS: VSYS1 (TMGFW): int1: vwire-int zone vwire_tmg int2: vwire-int zone vwire_external VSYS2 (CLIENTFW): int3: L3-int 10.x.x.x zone internal int4: L3-int 156.98.x.x zone external
... View more
