Virtual wire is nothing like just an access list. This is still a full session table firewall with the NGFW app detection and features for policies fully available. You can have two different zone names on the two joined interfaces like trust and untrust or you can have them in the same zone with intra zone policies. I have always seen it deployed with two zones. Virtual wire requires not participation in layer 2 or 3 protocols so it is very unobtrusive to existing network topologies. Thus I have mainly seen it deployed to isolate small numbers of devices or a physical section of the network topology without having to change any of the ip schemes at all. Some Common scenarios: Hospital equipment or PCI devices connected to the same VLAN as other devices in the area but needing to be more aggressively protected. PCI for regulatory reasons, hospital devices because they run very old unpatched operating systems due to testing regulations. DMZ areas where the desire is to have actual public addresses physically on server interfaces in applications like VOIP servers. The vwire inserts on the line into the DMZ switch invisibily and allows rules and sessions without any NAT in play.
... View more
