VLAN Interfaces on Palo Alto Firewalls

VLAN interfaces on Palo Alto Networks firewalls are utilized to segment network traffic logically. They allow for:

Configuration Steps (VLAN Interface / SVI)

  1. Configure Layer 2 Ethernet Interfaces :
    • Navigate to Network > Interfaces > Ethernet .
    • Select the desired physical interface (e.g., ethernet1/1 ).
    • Set the Interface Type to Layer2 .
    • Assign the interface to a Security Zone (this zone applies to traffic *on* this specific port if untagged, but the main policy will use the VLAN interface's zone).
  2. Create VLAN Objects :
    • Go to Network > VLANs .
    • Click Add to create a new VLAN object.
    • Provide a Name for the VLAN (e.g., VLAN10-Users).
    • Assign the previously configured Layer 2 physical interface(s) that will carry this VLAN to this VLAN object.
  3. Configure VLAN Interfaces (Logical Layer 3) :
    • Navigate to Network > Interfaces > VLAN .
    • Click Add to create a new logical VLAN interface.
    • The interface name is automatic (e.g., vlan). Assign it to the VLAN object created earlier (e.g., VLAN10-Users). Note: Unlike subinterfaces, the VLAN ID itself isn't part of the interface name here but is associated via the VLAN Object.
    • Set the Interface Type to Layer3 (this makes it an SVI - Switched Virtual Interface).
    • Assign an IP Address and netmask to the interface (e.g., 192.168.10.1/24 ). This becomes the gateway for devices in VLAN 10.
    • Associate it with a Virtual Router and a dedicated Security Zone (e.g., Zone-VLAN10). Policies will use this zone.
  4. Commit the Configuration :
    • After completing the above steps, click Commit to apply the changes.

References

Layer 2 & VLAN Interface Quiz

1. A customer wants to set up a Layer 3 VLAN interface (SVI) associated with a Layer 2 Ethernet port. Which two components are mandatory when configuring this Layer 3 VLAN interface? (Choose two.)

2. A company wants to install an NGFW firewall between two core switches using a VLAN trunk link. They need to assign each tagged VLAN to its own zone and also assign untagged (native) traffic to a separate zone. Which interface configuration approach allows for this separation?

3. A company wants to implement threat prevention by inserting a firewall into their network with minimal changes to the existing routing infrastructure. Which two deployment modes are best suited for this scenario? (Choose two.)