CloudLabBox
Try the free demo

Palo Alto NGFW lab 5 of 30

Virtual wire and Layer 2 deployments

Insert a firewall into a network without changing a single IP address: replace the factory-style virtual wire with your own, write policy between virtual-wire zones, then bridge two warehouse segments at Layer 2 with a VLAN object and control what crosses between them.

Run this lab

It needs Lite: its 5 nodes are set to 6 vCPU and 7,936 MB in total. That fits the free demo too.

In your workspace: Shared, then Palo Alto NGFW PAN-OS 11 guided labs, then 05 - Virtual wire and Layer 2 deployments

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 50 minutes
Nodes need
6 vCPU, 7,936 MB
Smallest plan
Lite

The scenario

The York warehouse network is flat: users and the uplink gateway share 10.20.0.0/24, and nobody wants to renumber it. Calder wants FW1 inserted between the users and the gateway, and between the handheld scanners and the label printers, without changing any IP address.

Two PAN-OS deployment modes do that:

  • a virtual wire for the user uplink;
  • Layer 2 bridging for the warehouse VLAN.
SegmentHostsFW1 port
UsersClient-PC 10.20.0.10 (gateway 10.20.0.1), FW1 management 10.20.0.254ethernet1/2
UplinkGateway 10.20.0.1 (web, SSH and FTP server)ethernet1/1
Scanners (VLAN 30)Scanner 10.30.0.10ethernet1/3
Printers (VLAN 30)Printer 10.30.0.20 (web admin on 80, raw print on 9100)ethernet1/4

Before you start. Start all the nodes. The firewall takes 6-8 minutes to boot and comes up with this lab's starting configuration already loaded. Wait until the FW1 console shows FW1 login:, then log in as admin / Lab-Access-1. Until the management plane is ready it answers Login incorrect, even with the right password. The Linux hosts are ready within seconds.

What you’ll practise

  • Explain how a virtual wire passes traffic transparently and what the hardware factory default-vwire does
  • Build a virtual wire with its own zones and write App-ID policy across it
  • Configure Layer 2 interfaces, a VLAN object and Layer 2 zones
  • Verify with show interface, show mac and the session table
  • Choose between virtual wire, Layer 2, Layer 3 and tap deployments

The tasks

  1. Explore the factory virtual wire
  2. Build your own virtual wire with named zones
  3. Bridge the warehouse VLAN at Layer 2
  4. Verify like an engineer
  5. Which deployment when?

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Virtual wire and Layer 2 deployments5 nodes and 4 networks, 9 links. Every link is listed as text below the diagram.FW1Client-PCGatewayScannerPrinterUsersUplinkScannersPrinterseth0eth0eth0eth0ethernet1/3ethernet1/4mgmtethernet1/2ethernet1/1
5 nodes and 4 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • FW1 mgmt to Users (network)
  • FW1 ethernet1/2 to Users (network)
  • FW1 ethernet1/1 to Uplink (network)
  • FW1 ethernet1/3 to Scanners (network)
  • FW1 ethernet1/4 to Printers (network)
  • Client-PC eth0 to Users (network)
  • Gateway eth0 to Uplink (network)
  • Scanner eth0 to Scanners (network)
  • Printer eth0 to Printers (network)
Nodes in Virtual wire and Layer 2 deployments, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
FW1Palo Alto Networks VM-Series (PAN-OS)paloalto-11.2.52 vCPU, 5,632 MB
Client-PCEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
GatewayEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 512 MB
ScannerEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 384 MB
PrinterEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 384 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Palo Alto NGFW PAN-OS 11 guided labs.

  3. Open 05 - Virtual wire and Layer 2 deployments and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Palo Alto NGFW labs

All Palo Alto NGFW labs

Related labs in other courses

CloudLabBox is independent of Palo Alto Networks and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.