Intervlan Routing in Palo Alto Firewall.
In Palo Alto firewall using Layer 3 interface type and creating sub interfaces we can do intervlan routing.
As shown in below diagram
eth1/1 is egress interface facing internet
eth1/2 is ingress interface facing LAN
Configuration of Zone
Configuration of VR
Configuration of Interfaces looks like -
L2 Switch configuration
On L2 Switch
int
eth0/0
Switchport
mode trunk
Switchport
trunk encap dot1q
int eth0/1
Switchport
mode access
Switchport
access vlan 100
int eth0/2
Switchport
mode access
Switchport
access vlan 200
int eth0/3
Switchport
mode access
Switchport
access vlan 300
Configuration on PC1 , PC2 and PC3
PC1
int eth0/0
ip address 192.168.10.100 255.255.255.0
no shut
ip route 0.0.0.0 0.0.0.0 192.168.10.1 ( L3 on PA eth1/2.100)
PC2
int eth0/0
ip address 192.168.20.100 255.255.255.0
no shut
ip route 0.0.0.0 0.0.0.0 192.168.20.1 ( L3 on PA eth1/2.200)
PC3
int eth0/0
ip address 192.168.30.100 255.255.255.0
no shut
ip route 0.0.0.0 0.0.0.0 192.168.30.1 ( L3 on PA eth1/3.200)
Verification
From PC1 ping 5.5.5.5 loopback on ISP
