Convert from vwire to layer 3 for globalprotect.

[Netwerx]

I'm trying to put together a plan of action to get globalprotect to work for us. I have a work ticket open with PA. Our PA firewall is currently deployed in a VWire setup, on the lan side of our router. Here are my big questions for getting this accomplished.

1) If I switch the vwire to layer 3 can I migrate the security profile name so I don't have to re-write every security policy?

2) Can the establishment of a virtual router on the layer 3 interface disrupt existing routes established by our physical router? This may be a silly question here. I'm just wondering if establishing a virtual router behind our physical one would disrupt or block any existing traffic routes, or if it would only momentarily establish new routes with RIP or the like.

[HULK]

Hello Sir,

(A) If you are planning to change the config from Virtual-wire to Layer-3,  you need not to re-write all security policies again.

1. You have to change the interface type, from vwire to Layer-3.

2. Change the Zone type from vwire to Layer-3

Example:

(B)  If i understand your query correctly,you can create a new virtual router for a Layer-3 interface and It would not impact on your existing routes established by your physical router. Until and unless you are not pointing any route to that/from Virtual router. Virtual router is a logical separation of routing table inside the same physical device.

Let us know if you need further information on this.

Thanks

[Netwerx]

Thank you very much. It is a great relief to not have to re-write the policies.

About the virtual router. I'm not trying to disrupt existing routes, but an only trying to make globalprotect portal and gateway work.

[hyadavalli]

Hello,

For your question 'A' Instead of re-writing security policies I'd recommend to change source and destination zones to any and then change zones from v-wire to L-3 and then refer the new zones in your security policies.

Hope it helps.

Regards,

Hari