Solutions

Connection between Switches and Palo Alto Firewall

For SW-1
For SW-2

Create MGMT Profile to allow Ping.

Network >> Interface Mgmt>> click Add>> Name Ping >> check on Ping >>click OK.
Zone Configuration

Network >> Zones >> click Add >> Name Zone >> type Layer2 >> click OK.

Network >> Zones >> click Add >> Name Zone >> type Layer3 >> click OK.

Create (L2-VLAN10, L2-VLAN20, L3-VLAN10, L3-VLAN20).

Interface Ethernet Configuration

Network >>Interfaces >> click on ethernet 1/1>>choose Layer 2 >> click OK and write Security Zone.
Interface VLAN Configuration

Network >>VLAN >> click Add VLAN Interface>> name VLAN ID >> Virtual Router Default and write
Security Zone>> click OK.
Assign IP Address.

Choose MGMT Profile that you created.

Security Policy Configurations.

Policies >> Security >> click Add >> Name VLAN10 to VLAN20 Zone

Choose Source Zone (VLAN10, VLAN20)

Choose Destination Zone (VLAN10, VLAN20)

Application Any. Service application-default. Action Allow. Check on Log at session and choose security
profiles.
Then click commit to apply the configuration.

Verification

VLAN10 to VLAN20

VLAN20 to VLAN10

End of Document