These are the only port groups that need to have their security settings adjusted. The following image shows the port groups assigned to the VM-Series. Three guest port groups: Lab_v10, Lab_v20 & Lab_v21 The following image shows the three guest port groups: Lab_v10, Lab_v20 & Lab_v21 Guest port groups do not need changes to the port group security settings. The VM-Series port groups are created as trunk ports (tagged) and for simplicity, we have grouped the untrusted VLAN in a single port group and the protected VLANs in another port group for the firewalls.ДЇor the VM-Series port groups ONLY, you have to allow for Promiscuous Mode, allowing MAC address changes, and allowing Forged Transmits. The port groups for the guests are set up as access port groups that have been assigned to a VLAN, but the VLAN is untagged to the guests. Looking at the Port Group configurations individually, we can see how they are set up. Uplink ports, LAB_vDS_Uplinks, connect this vSwitch to the physical network switches.

Two port groups were created for the firewall.

This design calls for several port groups to be configured on the vSwitch. To prevent the possibility of creating Layer 2 network loops, ports groups used for this solution have been configured with different VLAN-IDs.

Port groups can also be configured to be access ports (untagged) or trunk ports (tagged).

Port groups configured with different VLAN IDs are segregated from one another.

Port groups that share a common VLAN ID can communicate with each other.

Port groups can be assigned to different VLANs allowing for network to be segmented by VLAN ID. Port group A and port group B can be in the same VLAN and the guests in each port group will be able to talk to each other. There are many attributes that can be configured under a port group and the VLAN ID is one of those attributes. Port Groups are simply a collection of virtual ports that share a common configuration set. There is a misconception about what port groups are. The default configuration of a vSwitch, the initial port group configuration, and the vSwitch uplinks create a flat layer2 network. The distributed vSwitches by themselves do not necessarily segregate traffic between port groups.

The same principles that you would use to deploy our firewall in a physical networking environment are the same methodology you would use to deploy the VM-Series in a virtualized environment.Д«uilding the ESXi network topology is a crucial part of any layer 2 design. So the first thing I want you to do is to think about the solution as networking-not physical networking, not virtual networking, just networking. ESXi virtual switches work on similar principles to physical network switches (without MAC Learning). Often we make virtual networking more complicated than it needs to be. This design was tested with ESXi version 6.7u3, vCenter version 6.7, VM-Series PanOS version 9.1.2. The uplink will be configured to trunk VLANs to the physical datacenter switch.Дiagram of Uplinks ports trunk ESXi VLANS Requirements To prevent layer2 loops in the virtual and physical networks, each port group will require a different VLAN-ID. Port Groups are used to segregate traffic between the untrusted side and the trusted side of the firewall. A single Distributed vSwitch will be used in this example topology. This technote will cover a multiple ESXi host environment showcasing east/west traffic separation to demonstrate the Layer 2 capabilities of the VM-Series next-generation firewall.ДЄ highly available Active/Passive pair of VM-Series next-generation firewalls are positioned between the physical datacenter network and Guest VM workloads.

The basis for this design is to provide maximum flexibility with regards to VM-Series placement, guest VM protection, and the inherent networking capabilities of the ESXi hypervisor. Learn about topology, system requirements, and VM-Series Layer 2 Configuration.Дeploying the VM-Series on ESXi in Layer 2 ModeДЄll virtual machines on the ESXi hosts will be segregated from each other on the network by the VM-Series NGFW by manipulating VLAN tags and preserving existing Layer 3 gateways. Palo Alto Networks covers the deployment of the VM-Series Next-Generation Firewall on the ESXi hypervisor in Layer2 mode.

Esxi show mac address table