10.1 Virtual Systems (VSYS), Logical Routers, and Inter-VSYS Routing
Key Takeaways
- A Virtual System (VSYS) is a separate, independently managed logical firewall instance running on a single physical Palo Alto Networks firewall, used for multi-tenant segmentation without additional hardware.
- Each VSYS has its own interfaces, zones, virtual routers, security policies, administrators, and object namespace, and additional VSYS beyond the base count per NGFW series requires a Virtual Systems license.
- Inter-VSYS traffic that must stay within the firewall uses External zones, with each VSYS creating an External zone that references the destination VSYS, plus inter-virtual-router static routes when the VSYS use separate virtual routers.
- Logical routers are an advanced-routing construct that groups and segments routing tables above the virtual router level, used for large multi-tenant designs where routing must be isolated per tenant.
- When two VSYS share the same virtual router, no inter-VSYS static route is required because routing reaches the shared table directly.
10.1 Virtual Systems (VSYS), Logical Routers, and Inter-VSYS Routing
Task 2.2 of the NGFW Engineer blueprint covers configuring virtual systems (VSYS) along with their interfaces, zones, virtual routers, logical routers, and inter-VSYS routing and security. VSYS let a single physical firewall behave as several independent firewalls, which is essential for managed service providers and large enterprises that must isolate tenants on shared hardware.
What a Virtual System Is
A Virtual System (VSYS) is a separate, logical firewall instance hosted on one physical Palo Alto Networks firewall (or one member of an HA pair). Each VSYS operates as an independently managed firewall:
- Dedicated interfaces and zones: Physical and subinterface ports are allocated to specific VSYS.
- Dedicated virtual routers: Each VSYS can have its own virtual router so routing tables do not leak between tenants.
- Dedicated security policies: Security, NAT, and decryption policies belong to a VSYS (or to the shared scope).
- Dedicated administrators: VSYS-level admin roles restrict a tenant administrator to only their VSYS.
- Separate object namespace: Address objects, service objects, and profiles can be VSYS-scoped or shared.
Licensing
Each NGFW series supports a base number of VSYS at no extra cost. Any VSYS beyond that base count requires a Virtual Systems license. When managed by Strata Cloud Manager, VSYS support additionally requires Strata Cloud Manager Pro or Essentials and must be enabled by the account team.
Virtual Routers vs Logical Routers
The blueprint lists both virtual routers (2.2.2) and logical routers (2.2.3), and they are distinct advanced-routing constructs in PAN-OS.
| Construct | Role |
|---|---|
| Virtual Router (VR) | The base routing instance. Holds a routing table (RIB/FIB), runs static and dynamic routing, and is assigned to a VSYS (or shared). Most designs assign one VR per VSYS. |
| Logical Router | A higher-level advanced-routing construct used to group and segment routing for complex multi-tenant designs. A logical router can contain multiple virtual routers and provides routing isolation above the per-VR level. |
In a simple single-tenant design an engineer only ever sees a single virtual router. Logical routers become relevant in large deployments where routing must be isolated and aggregated per tenant or per routing domain beyond what individual virtual routers express.
Inter-VSYS Routing
Two VSYS on the same firewall often need to exchange traffic without that traffic ever leaving the firewall on a physical cable. PAN-OS handles this with External zones and, when the VSYS use separate virtual routers, inter-virtual-router static routes.
Two Inter-VSYS Cases
- Inter-VSYS traffic that must leave the firewall: A physical cable connects a port in one VSYS to a port in another VSYS (or to an external switch). This is rarely used but supported.
- Inter-VSYS traffic that stays within the firewall (the common case): No physical cable is used. An External zone in each VSYS represents the destination VSYS.
Configuration Steps (within-firewall case)
- Assign interfaces and a virtual router to each VSYS.
- In each VSYS, create a zone of type External and add the destination VSYS to it. An External zone represents the remote VSYS inside the local VSYS configuration.
- If the two VSYS use different virtual routers, add inter-virtual-router static routes: on the source VSYS's VR, add a static route for the remote subnet whose next hop is the remote VSYS's virtual router, and add the return route on the remote VR.
- If both VSYS use the same virtual router, no inter-VSYS route is needed because both reach the shared routing table directly.
- Add security policies in each VSYS permitting traffic between the local zone and the External zone (outbound on the source VSYS, inbound on the destination VSYS).
Session Behavior
Inter-VSYS communication uses two sessions, not one: the firewall creates one session for the source VSYS to the External zone and a second session for the External zone to the destination VSYS. Both sessions must be permitted by their respective VSYS security policies, which is why a policy on only one side leaves the traffic blocked in one direction.
Shared Objects and VSYS-Specific Objects
Objects and profiles can be shared (visible to all VSYS) or VSYS-specific (visible only to that VSYS). Multi-tenant best practice is to keep tenant-specific address objects and policies VSYS-scoped while sharing globally consistent profiles (such as decryption and threat-prevention profiles) to reduce duplication. A VSYS administrator with a VSYS-scoped role cannot see or edit shared objects unless their role grants shared access.
VSYS and High Availability
VSYS exist on each member of an HA pair and are synchronized by HA configuration sync. Each VSYS can fail over independently in an active/active deployment, which lets one VSYS run on peer A while another runs on peer B. This is one reason the blueprint treats VSYS as a device-setting configuration rather than a networking-only topic.
Two virtual systems (accounting and marketing) on the same firewall must exchange traffic without the traffic ever leaving the firewall on a physical cable. The VSYS use separate virtual routers and inter-VR static routes have been configured, External zones are created, and security policies permit local-to-External traffic. Traffic still fails in one direction. What explains the two-session behavior and the likely missing piece?
A managed service provider wants to host four tenants on a single PA-3420, but the PA-3400 Series base license only includes a smaller number of virtual systems. What is required to enable the additional VSYS?
Two VSYS on the same firewall must route to each other's subnets. Under which condition is an inter-VSYS static route NOT required?