About indysogi

Hi,   I am trying to get my head around VWIRE and how it supposed to work.   We have the following scenario   SWITCH -> VIRTUAL FIREWALL (ON SHARED HOST) -> INTERNET   We are now looking to do   SWITCH -> PALO ALTO -> VIRTUAL FIREWALL (ON SHARED HOST) -> INTERNET   I am thinking how this would work physically. The virtual firewall sits on a VM host (shared with other VMs) which plugs directly into the switch.  It is a flat network.  Therefore both e1/1 and 1/2 on the palo will go into the same VLAN.  How would the Palo know how to intercept the traffic with the client machines default gateway being the virtual firewall which also sits in the same VLAN and also on the same switch.  I have seen articles that e1/1 and e1/2 should be connected to the same VLAN either side be it an access or trunk port, then I have seen articles were e1/1 and e1/2 are in different VLANs.   The physical architecure iof vWIRE in terms how to cable this up is not documented anywhere really. Some feedback would be very much appreciated.  Thanks ... View more

Hi,   I was wondering whether someone can provide me clarification on this feature.   Palo states  "You can now disable direct access to local networks so that users cannot send traffic to proxies or local resources while connected to a GlobalProtect VPN. For example, if a user establishes a GlobalProtect VPN tunnel while connected to a public hotspot or hotel Wi-Fi, and this feature is enabled, all traffic is routed through the tunnel and is subject to policy enforcement by the firewall."   I was under the impression that security policies would enforce what a GP VPN client can access or not including local networks as well as advising the access routes.  Are Palo saying local networks/zones/interfaces directly conneced to the firewall?  If the security policy allows access to proxies or local resources, surely this feature would be useless. ... View more