1.3 Interface Types, Zone Topologies, and Virtual Wire Configurations

1.3 Interface Types, Zone Topologies, and Virtual Wire Configurations

Designing network interfaces and security zones is the fundamental step in establishing security boundaries on a Palo Alto Networks Next-Generation Firewall. PAN-OS provides flexible interface operational modes designed to accommodate any network architecture—from non-disruptive passive monitoring to transparent inline bridging and complex multi-VLAN Layer 3 routing.

---

PAN-OS Interface Types Overview

Every physical port on a Palo Alto Networks firewall must be configured for a specific operational interface mode based on its position in the network topology.

1. Tap Interface Mode

• Function: Connects to a switch SPAN (Switched Port Analyzer) or network TAP device for passive monitoring.
• Traffic Flow: Receive-only mode. The firewall inspects mirrored traffic streams for threat identification, App-ID logging, and User-ID mapping.
• Key Limitation: Because the firewall operates out-of-line on a copied traffic stream, it cannot block malicious traffic inline. It can only generate threat logs and optional TCP Reset packets.

2. Virtual Wire (VWire) Interface Mode

• Function: Binds two physical interfaces together to form a transparent inline Layer 2 bridge.
• Traffic Flow: Packets entering port A exit port B unmodified, and vice versa. The VWire acts like a physical wire with full NGFW inspection.
• Key Characteristics: Requires no IP address assignment on the interfaces, does not participate in MAC learning or Spanning Tree Protocol (STP), and preserves original 802.1Q VLAN tags and IP/MAC headers.
• Use Cases: Rapid deployment into existing networks without altering IP subnets, default gateways, or router topologies.

3. Layer 2 Interface Mode

• Function: Operates as a stateful Layer 2 switch port.
• Traffic Flow: Switches traffic between interfaces within the same VLAN based on MAC address learning.
• Key Characteristics: Supports VLAN interfaces (Switch Virtual Interfaces / SVIs) for Layer 3 gateway terminating, MAC address table management, and 802.1Q VLAN trunking.

4. Layer 3 Interface Mode

• Function: Operates as a traditional routed interface.
• Traffic Flow: Routes traffic between subnets using assigned IP addresses.
• Key Characteristics: Supports static routing, dynamic routing protocols (BGP, OSPF, RIP), Network Address Translation (NAT), IPsec VPN tunnel termination, and IPv6 routing.

5. Aggregate Ethernet (AE) Interface Mode

• Function: Combines multiple physical interfaces into a single logical link group using IEEE 802.3ad Link Aggregation Control Protocol (LACP).
• Key Characteristics: Delivers increased bandwidth and physical interface redundancy. Supports configuring a minimum-links threshold (shutting down the AE logical bundle if active physical member links drop below the threshold).
• Flexibility: AE interfaces can be configured as Layer 2, Layer 3, or Virtual Wire logical interfaces.

6. Subinterfaces (802.1Q VLAN Encapsulation)

• Function: Logically divides a physical or Aggregate Ethernet interface into multiple virtual subinterfaces using 802.1Q VLAN tagging.
• Use Cases: Multi-tenant segmentation, router-on-a-stick topology, and VLAN trunking.

---

Interface Type Operational Matrix

---

Security Zones & Zone Binding Rules

In PAN-OS, security policies are never applied directly to physical interfaces. Instead, policies are enforced strictly between Security Zones.

Fundamental Zone Architecture Principles

1. Logical Abstraction: A Security Zone is a logical grouping of one or more interfaces that share common security requirements (e.g., Trust, DMZ, Untrust).
2. Strict Single-Zone Binding: Every active interface (or subinterface) MUST be assigned to exactly one Security Zone. An interface cannot exist in multiple zones simultaneously.
3. Zone Type Matching: A Security Zone has a designated type (Tap, Virtual Wire, Layer 2, Layer 3, or Tunnel) that must match the mode of the interfaces assigned to it. For example, a Layer 3 interface cannot be assigned to a Virtual Wire security zone.

Default Implicit Security Policy Behavior

PAN-OS enforces two mandatory implicit rules at the bottom of every security policy rulebase:

• Implicit Intra-zone Rule (intrazone-default): Traffic originating and terminating within the same Security Zone is ALLOWED by default.
• Implicit Inter-zone Rule (interzone-default): Traffic passing between different Security Zones is DENIED by default.

Default Implicit Security Rules:
Source Zone == Destination Zone  --->  ACTION: ALLOW (Intra-zone)
Source Zone != Destination Zone  --->  ACTION: DENY  (Inter-zone)

---

Virtual Wire Deep-Dive: Link Pass-Through & Subinterfaces

Virtual Wire is one of the most powerful deployment modes in PAN-OS, allowing inline inspection without network disruption.

Link Pass-Through

In a standard VWire configuration, if an upstream router connected to VWire Port A fails, the downstream switch connected to VWire Port B might still show a link-up status, preventing network convergence protocols (like HSRP/VRRP or dynamic routing) from failing over.

Link Pass-Through resolves this issue:

• When Link Pass-Through is enabled, if Port A loses physical link connection, PAN-OS automatically downs the link on Port B.
• This mirrors physical link status across the VWire pair, triggering immediate link-down state on connected network devices and initiating fast network failover.

Virtual Wire Subinterfaces for Multi-VLAN Inspection

By default, a physical VWire pair passes all VLAN tags (or untagged traffic) between its two ports within a single VWire security zone.

However, when an enterprise wants to apply different security policies to individual VLANs traversing the same physical VWire pair, administrators create VWire Subinterfaces:

1. Define physical ports ethernet1/1 and ethernet1/2 as Virtual Wire ports.
2. Create subinterfaces ethernet1/1.10 and ethernet1/2.10 with 802.1Q Tag 10.
3. Create subinterfaces ethernet1/1.20 and ethernet1/2.20 with 802.1Q Tag 20.
4. Pair subinterface .10 into VWire-VLAN10 and bind it to Zone-VLAN10.
5. Pair subinterface .20 into VWire-VLAN20 and bind it to Zone-VLAN20.

This configuration enables granular, per-VLAN security policies, threat inspection, and decryption rules over a single physical cable pair.