Is it possible that traffics go on each other sub-interfaces with same physical interface?

[KiCheon.Lee]

Hello.

I want to make the following network-diagram. Is it possible?

A Cisco Nexus              Paloalto

VRF-1 ----------------------> eth1/1.1 | 1.1.1.1 | VR : default | trust

                 tag 10                                |

                                                          |

VRF-2 <--------------------- eth1/1.2 | 2.2.1.1 | VR : default | untrust

                tag 20

1. Traffics go into sub-interface eth1/1.1 with tag 10.

2. FW process routing and policing.

3. Traffics go out from sub-interface eth1/1.2 with tag 20.

Two sub-interfaces are on same physical interface.

Thanks,

KC Lee

[RohJaewoong]

Hi,

I think it is possible to work because sub-interfaces are different interface logically with tag number.

Thanks.

Regards,

Roh

[dreputi · Accepted solution]

Hello Cheon,

Yes this is possible. You have to make sure the following are in place:

-Layer3 subinterface eth1/1.1 configured for tag 10 , zone-x, ip-1.1.1.1/netmask

-Layer3 subinterface eth1/1.2 configured for tag 20 , zone-y, ip-2.2.1.1/netmask

-Security rules allowing traffic between zone x and y as required.

-optional-any other policies like nat etc.

Regards,

Dileep

[hshah]

Hi Cheon,

Its very much possible, too many customer has this implementation. Good thing is you dont have to configure any special routing because both the interfaces on PANW are on same VR.

Refer following document on sub-interfaces

How to Create Tagged Sub-Interfaces

Regards,

Hardik Shah

[panos]

Also you can read Securing Inter VLAN Traffic for further information.

[KiCheon.Lee]

Wow~.

Thank you very much~ Roh, dreputi, hshah, panos.

My worry is broken by you and get good energy.