Configure Virtual Wires

Create the first virtual wire interface.
Select
Network
Interfaces
Ethernet
and select an interface you have cabled (
ethernet1/3
in this example).
Set the
Interface Type
to
Virtual Wire
.
Attach the interface to a virtual wire object.
While still on the same Ethernet interface, on the
Config
tab, select
Virtual Wire
and click
New Virtual Wire
.
Enter a
Name
for the virtual wire.
For
Interface1
, select the interface you just configured (
ethernet1/3
). (Only interfaces configured as virtual wire interfaces appear in the list.)
For
Tag Allowed
, enter
0
to indicate untagged traffic (such as BPDUs and other Layer 2 control traffic) is allowed. The absence of a tag implies tag 0. Enter additional allowed tag integers or ranges of tags, separated by commas (default is 0; range is 0 to 4,094).
Select
Multicast Firewalling
if you want to be able to apply security policy rules to multicast traffic going across the virtual wire. Otherwise, multicast traffic is transparently forwarded across the virtual wire.
Select
Link State Pass Through
so the firewall can function transparently. When the firewall detects a link down state for a link of the virtual wire, it brings down the other interface in the virtual wire pair. Thus, devices on both sides of the firewall see a consistent link state, as if there were no firewall between them. If you don’t select this option, link status is not propagated across the virtual wire.
Click
OK
to save the virtual wire object.
Determine the link speed of the virtual wire interface.
While still on the same Ethernet interface, select
Advanced
and note or change the
Link Speed
. The port type determines the speed settings available in the list. By default, copper ports are set to
auto
negotiate link speed. Both virtual wire interfaces must have the same link speed.
Click
OK
to save the Ethernet interface.
Configure the second virtual wire interface (
ethernet1/4
in this example) by repeating the preceding steps.
When you select the
Virtual Wire
object you created, the firewall automatically adds the second virtual wire interface as
Interface2
.
Create a separate security zone for each virtual wire interface.
Select
Network
Zones
and
Add
a zone.
Enter the
Name
of the zone (such as
internet
).
For
Location
, select the virtual system where the zone applies.
For
Type
, select
Virtual Wire
.
Add
the
Interface
that belongs to the zone.
Click
OK
.
(
Optional
) Create security policy rules to allow Layer 3 traffic to pass through.
To allow Layer 3 traffic across the virtual wire, Create a Security Policy Rule to allow traffic from the user zone to the internet zone, and another to allow traffic from the internet zone to the user zone, selecting the applications you want to allow, such as BGP or OSPF.
(
Optional
) Enable IPv6 firewalling.
If you want to be able to apply security policy rules to IPv6 traffic arriving at the virtual wire interface, enable IPv6 firewalling. Otherwise, IPv6 traffic is forwarded transparently.
Select
Device
Setup
Session
and edit Session Settings.
Select
Enable lPv6 Firewalling
.
Click
OK
.
(
Supported firewalls only
) If the interface corresponds to a PoE (Power over Ethernet) port on the firewall, you can optionally configure PoE.
Commit
your changes.
(
Optional
) Configure an LLDP profile and apply it to the virtual wire interfaces (see Configure LLDP).
(
Optional
) Apply non-IP protocol control to the virtual wire zones (Configure Protocol Protection). Otherwise, all non-IP traffic is forwarded over the virtual wire.