Scribd
Upload
78 views13 pages

Paloalto Subinterface SOP

1. The document discusses configuring layer 3 subinterfaces on a Palo Alto Networks firewall to segment VLAN traffic. This involves creating subinterfaces tagged for each VLAN, moving DHCP and NAT configurations to the subinterfaces, and creating security policies between zones. 2. Key steps are removing the IP from the physical interface, adding subinterfaces tagged for each VLAN with IPs, reconfiguring DHCP to the subinterface, creating a NAT policy for external access to an internal webserver, and security policies between zones to allow required traffic. 3. After committing the new configuration, the physical interface will accept tagged packets for both VLANs and the webserver will be accessible externally via NAT.

Uploaded by

ankit
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
78 views13 pages

Paloalto Subinterface SOP

1. The document discusses configuring layer 3 subinterfaces on a Palo Alto Networks firewall to segment VLAN traffic. This involves creating subinterfaces tagged for each VLAN, moving DHCP and NAT configurations to the subinterfaces, and creating security policies between zones. 2. Key steps are removing the IP from the physical interface, adding subinterfaces tagged for each VLAN with IPs, reconfiguring DHCP to the subinterface, creating a NAT policy for external access to an internal webserver, and security policies between zones to allow required traffic. 3. After committing the new configuration, the physical interface will accept tagged packets for both VLANs and the webserver will be accessible externally via NAT.

Uploaded by

ankit
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 13

Getting Started: Layer 3 Subinterfaces

260712
Created On 09/25/18 18:55 PM - Last Modified 07/18/19 20:11 PM
INTERFACES
LAYER 3
VLAN
PAN-OS

Symptom
Now that your new Palo Alto Networks firewall is up and running, let's look at adding VLAN tags to the mix by
creating Layer 3 subinterfaces. Our initial installments in the Get Started series described the first steps after
unpacking your firewall and getting it updated and configured in VWire or Layer 3 mode. Check out I've unpacked my
firewall, now what? and I've unpacked my firewall and did what you told me, now what?

There may be several network segments in your organization to segregate user workstations from public web
servers. A good way to prevent these networks from communicating with each other is by implementing VLANs on
the core switch, preventing hosts located in one VLAN from communicating with hosts in another, without some form
of bridge or gateway to connect both virtual networks.

Resolution

The first configuration we'll look at builds on where we left off in the previous getting started guide. The firewall has
Layer 3 interfaces and we're now going to change the trust interface so it can communicate with a trunked switch
interface.

The difference between a regular, or access, switchport configuration and a trunked switchport, is that
the access port will not tamper with the Ethernet header with any packets, whereas a trunk port will attach a
VLAN tag in the form of a IEEE 802.1Q header to packets. This ensures that packets retain VLAN information outside
the switch and should be treated as different LAN networks by the next host receiving these packets.

interface GigabitEthernet1/36
switchport
switchport access vlan 100
switchport mode access
switchport nonegotiate
spanning-tree portfast

...reconfigure...

interface GigabitEthernet1/36
switchport
switchport trunk allowed vlan 100,200
switchport mode trunk
switchport nonegotiate
spanning-tree portfast

We'll be switching our configuration from a regular interface to tagged subinterfaces.


1. Creating subinterfaces

The first step is to remove the IP configuration from the physical firewall.

1. Navigate to the Network tab.


2. Go to Interfaces on the left pane.
3. Open the interface configuration.
4. Navigate to the IPv4 tab.
5. Select the subnet.
6. Click Delete.

We can now go ahead and add a subinterface.


In the subinterface configuration, we need to assign an interface number and a tag. The tag needs to match the
VLAN exactly, but the interface number may be different. For ease of management, it's best to set it the same id as
the VLAN tag. Add the interface to the 'default' Virtual Router and assign it to the 'trust' Security Zone.

Next, navigate to the IPv4 tab and add the IP to the interface.
Then navigate to the Advanced tab and set the Management Profile to 'ping.'

Next, we've added a web server to the network and placed it in VLAN 200 on the switch.
So we'll need to add a second subinterface and set it to VLAN tag 200. We'll also create a new Security Zone so we
can apply different security policy to it.

We'll call the new zone 'dmz'


and assign the interface a different IP subnet
and we'll also set the Management Profile to 'ping.'

Your interface configuration should now look similar to this:

2. Reconfigure DHCP

We will now need to move the DHCP server we created last time to the new subinterface.

1. Navigate to the Network tab.


2. Open DHCP menu from the left pane.
3. Open the DHCP configuration for interface ethernet1/2.
4. Change the Interface to ethernet1/2.100 to match the new subinterface.
3. Create a new NAT policy

The next step is to create a NAT policy to allow hosts on the internet to reach the webserver via the external IP
address of the firewall.

1. Navigate to the Policies tab.


2. Open NAT configuration from the left pane.
3. Click Add to create a new NAT policy.

In the Original Packet tab, we set the source and destination zones to untrust, the destination interface to the external
interface and the destination address to the external IP address of the firewall. The destination zone is untrust
because the firewall will try to determine the destination zone of a received packet based on its routing table. In this
case, the original destination IP address, before NAT is applied, belongs to the untrust zone.
In the Translated Packet tab, we add the physical IP address of the webserver.

4. Add security policy

The last step is to create security policies to allow the trust and untrust zone to access the web server.

1. Navigate to Policies.
2. Open the Security policies from the left pane.
3. Click Add to create a new rule and name it access_to_webserver.
For now, we'll set the source zone to 'untrust.'

We'll set the destination to 'dmz' and the destination address to the external IP of the firewall.

We'll enable application web-browsing.


Enable several security profiles to make sure the webserver is protected from attacks.

Repeat this step for a security policy from the trust zone, so additional applications can be added.
In the destination, we'll set Security Zone 'dmz' and the internal IP address of the webserver.

Add additional applications for management.


Your security policy should now look similar to this:

After you commit this new configuration, interface ethernet1/2 will accept 'tagged' packets for VLAN 100 and 200 and
the webserver will become available to the outside world.

Thank you for reading—please leave any comments in the comment section below.

Regards,

Tom

If you've enjoyed this article, please also take a look at the follow-up article:

You might also like