# Zones, interfaces & virtual routers — the forwarding skeleton

Source: https://ai.techclick.in/blog_paloalto_zones_interfaces_vr
Markdown: https://ai.techclick.in/blog_paloalto_zones_interfaces_vr.md
Publisher: Techclick Infosec Pvt Ltd

PAN-OS forwarding skeleton: pick L3 vs vwire vs tap, bind the interface to the zone the Security rule matches, attach every L3 interface to a virtual router, and know when PBF must override that VR.

Quick answer (say this out loud)

   An interface is how the packet enters. A  zone  is the Security-policy door on that interface. A  virtual router  is how Layer 3 traffic finds the egress interface — and the  destination zone is the zone of that egress interface .  L3  needs an IP + VR + zone and becomes the gateway.  Virtual wire  binds two ports with no MAC or IP and still enforces policy (factory default is ethernet1/1–1/2).  Tap  is a SPAN copy: you can log and alert, you cannot block. Write the Security rule with the  same zone names  you put on the interfaces. Use  PBF  only when destination-IP lookup in the VR is the wrong answer — and only on Layer 3 interfaces, not loopbacks.

## 1. Why the skeleton comes first

 A Security rule cannot invent a door. If ethernet1/15 sits in zone  Users  and you write Source Zone  trust , the packet never matches your rule. It falls to  interzone-default  (deny, logging off). The operator then “fixes policy” for an hour.

 The same packet can also die one step later: the interface has an IP and a zone, but no virtual router. PAN-OS lets you commit that. The VR column in  show interface all  is empty. Layer 3 traffic black-holes with no Security hit to argue about.

   Hero · who talks to whom

   Notice: users, internet, and the data center do not talk to “the firewall.” They talk to  zones  on interfaces. The virtual router only decides the next hop for Layer 3.

 Three more reasons this is not “just ports”:

- Zone type must match interface type. A Layer 3 interface goes in a Layer 3 zone. A vwire interface goes in a virtual-wire zone. Mixing them will not commit the way you think.

- Defaults are opposite by zone relationship. Same-zone traffic is allowed by intrazone-default . Different-zone traffic is denied by interzone-default . Put two sensitive subnets in one zone and they can talk with logging off.

- Destination zone is post-forwarding. Official VR docs: the destination zone is derived from the outgoing interface after the route (or PBF) lookup. Get the egress wrong and the Security dest-zone is wrong too.

   Hard words before the runbook

    Interface type  — Layer3, Layer2, Virtual Wire, Tap, HA, plus logical types (VLAN, loopback, tunnel, aggregate). Set on  Network → Interfaces .

    Security zone  — a label on one or more interfaces. Security, NAT, and PBF match  zones , not ethernet names.

    Virtual router (VR)  — the Layer 3 routing instance. RIB holds learned/static routes; the best route is installed in the FIB. Each L3 Ethernet, VLAN, loopback, and tunnel interface belongs to exactly one VR.

    PBF  — Policy-Based Forwarding. Overrides the VR’s destination-IP lookup and pins an egress interface using source zone/interface, address, user, dest, app, or service.

    Virtual wire (vwire)  — two ports bound together. No MAC, no IP, no switching, no routing. Policy still runs. Factory ships ethernet1/1 and ethernet1/2 this way.

## 2. Mental model · interface → zone → VR

 Hold three parts. Interviews fail when people treat “zone” as a Cisco ACL interface or treat the VR as optional decoration.

   Journey · four objects, one packet

   Read left to right. Interface is the cable. Zone is the policy door. Virtual router (L3 only) picks the egress. The Security rule must name both doors.

#### 1. Interface

     How the frame arrives. Mode decides whether you are a gateway (L3), a bump in the wire (vwire), a switch (L2), or a passive SPAN listener (tap).

#### 2. Zone

     The Security match field. Source zone = zone of the ingress interface. Destination zone = zone of the egress interface after forwarding. Tap rules use the  same  tap zone on both sides.

#### 3. Virtual router

     L3 only. Builds RIB from static + OSPF/BGP/RIP, installs the lowest administrative-distance route in the FIB, forwards. No VR = no L3 next hop.

#### Override: PBF

     If dest-IP in the VR is the wrong key (guest to cheap ISP, finance to MPLS), a PBF rule picks the egress first. Security still uses the zone of whatever egress you chose.

   Say this out loud

   The cable is the interface. The door is the zone. The map is the virtual router. The Security rule names two doors, not two cables. PBF rewrites the map; it does not invent a door.

   Flow 1 · forwarding skeleton

       PAN-OS forwarding skeleton: interface to zone to VR or PBF to security rule

- New session arrives on an interface Ingress IF ethernet1/15 Source zone zone on that IF L3 mode? needs a VR YES VR or PBF picks egress IF + dest zone NO · vwire / tap / L2 No route lookup vwire pair · tap same zone · L2 VLAN Security rule: Source Zone + Dest Zone must match First full match wins · else interzone-default deny / tap needs same-zone allow Trap: rule written for trust → untrust while the IF lives in Users. Dest zone also wrong if PBF/VR sent the packet out a different door. Read left → right, then down. Diamond = “does this interface route?” Green box is L3 only. The blue Security box still applies to vwire and tap. ## 3. Decision flow · L3 vs vwire vs tap Do not start in Network → Interfaces until you can answer two questions: must I become the gateway, and must I be able to drop? Path · three modes L3 = you own IPs and routing. Vwire = insert without re-IP and still enforce. Tap = copy only — visibility, no drop. Flow 2 · pick the interface type Choose Layer 3, virtual wire, or tap How should the NGFW sit on this link? Must we drop traffic? Inline and enforce? NO · SPAN only Tap alert, cannot block YES Re-IP / become the gateway? YES Layer 3 IP + zone + VR NAT / VPN / PBF live here NO · keep existing IPs Virtual wire pair two ports no MAC, no IP, still policy Also on this page, but not a third “inline IPS mode” Layer 2 = switching / VLAN; needs a VLAN interface + VR to leave the L2 domain. Tunnel / loopback / AE are logical types that still sit in a zone (and a VR if they route). Factory default: ethernet1/1 + 1/2 are already a vwire. Delete that pair if you will reuse those ports as L3. Diamond 1 = can we drop. Diamond 2 = will we own IPs. Tap is never an enforcement design. Vwire is the insert-without-re-IP design. L3 is the production gateway design. Do not do this Do not pick tap “to be safe” on a production internet edge and then write Deny rules. Official tap help: the firewall is not in the flow, so it cannot block threats or apply QoS. Profile actions on tap must be alert . Source zone and destination zone on the tap Security rule must be the same tap zone . ## 4. How to choose mode, zone, VR vs PBF Use the mode table first, then the forwarding table. Mixing them is how dual-ISP tickets become “sometimes works.” You need Interface type Zone VR? What you get Firewall is the default gateway / NAT / IPsec / PBF Layer3 (+ optional sub-IF) Layer 3 zone (Users, Internet, Data Center Applications) Required — one VR per IF Routing, NAT, VPN, PBF, Interface Management profile (ping) Insert between two existing devices with no re-IP, still drop Virtual Wire (pair two ports) Virtual-wire zones on each side (or one zone if you want intrazone-allow) No Bump-in-the-wire. Policy, App-ID, decryption, NAT, HA. No MAC/IP. VLAN tags optional (0 = untagged). SPAN / mirror visibility only Tap One tap zone (example TapZone ) No Logs + ACC + alert profiles. Cannot block. Security rule is same-zone allow. Switch VLANs on the firewall Layer2 + VLAN interface Layer 2 zone on the L2 ports; L3 zone on the VLAN IF On the VLAN interface only Switching inside the VLAN; routing only when the VLAN IF is in a VR Source for the L3 click path: Configure Interfaces and Zones . Vwire: Virtual Wire Interfaces . Tap: Tap Interfaces . ### VR versus PBF Normally the firewall uses the destination IP against the routing table of the VR attached to the ingress interface. That lookup returns the egress interface — and therefore the destination zone. Use When Do not use when Virtual router (static / OSPF / BGP) Every host to a prefix should take the same next hop. Default AD: static 10, EBGP 20, OSPF internal 30, OSPF external 110, RIP 120, IBGP 200. Lowest AD wins. You need different exits for the same dest IP based on who or what app . Second VR + next-vr static You need a separate RIB (second BGP Local AS, overlapping RFC1918, vsys isolation). Official note: one hop only (A→C, not A→B→C). You only wanted “guest uses ISP2.” That is PBF or a more-specific static, not a second AS. PBF Override dest-IP lookup using source zone or interface, source address, source user, dest, application, or service. Dual-ISP “this subnet / this app out ISP2.” Tap or vwire (PBF is Layer 3 only). Loopback is explicitly unsupported. You wanted a zone — write the Security rule instead. Source: Policy-Based Forwarding and Configure Virtual Routers . Symmetric return on PBF requires the Source Interface (not only a zone) so the firewall can pin the return path. ## 5. Runbook · Side A interface+zone, Side B VR, Side C rule+proof Lab story (official getting-started numbers, RFC 5737): ethernet1/15 is users at 192.168.1.4/24 zone Users . ethernet1/8 is internet at 203.0.113.23/24 zone Internet , default route next hop 203.0.113.1 . Both in VR default . You will delete the factory vwire if those ports are in the way, build the two L3 interfaces, add the default route, write one Security allow, and prove zone names in the Traffic log. Primary source for clicks: Configure Interfaces and Zones (PAN-OS) . ### Side A — interface and zone #### Clear the factory virtual wire if you need those ports New hardware ships ethernet1/1 and ethernet1/2 as a vwire that allows untagged traffic, plus a matching default Security rule. If you will reuse those ports as L3, delete the vwire, its zones, and that default rule, then Commit . Official getting-started text: leave it and it interferes with later settings.

- #### Build the internet interface Network → Interfaces → Ethernet → ethernet1/8 . Interface Type = Layer3 . Config tab: Security Zone → New Zone → Name Internet . Virtual Router = default . IPv4 → Add 203.0.113.23/24 . Advanced → Other Info → Management Profile → New → enable Ping only if you want to ICMP the IF. OK.

- #### Build the users interface Network → Interfaces → ethernet1/15 . Interface Type = Layer3. New Zone Users . Same Virtual Router default . IPv4 192.168.1.4/24 . Same management profile if you want ping. OK.

- #### Optional DC segment Official third interface: ethernet1/1 Layer3, new zone Data Center Applications , same VR, 10.1.1.1/24 . Granular zones stop lateral movement that a single trust zone would allow via intrazone-default .

     https://fw.lab.example.com/#network/interfaces/ethernet1/15

     Training mock · not live

       Network → Interfaces → Ethernet → ethernet1/15

### Ethernet Interface

         Config
         IPv4
         IPv6
         Advanced

           Interface Name
           ethernet1/15

           Interface Type
           Layer3

           Virtual Router
           default

           Security Zone
           Users · New Zone…

         IPv4 (on IPv4 tab → Add)
         192.168.1.4/24

       Placeholder from official getting-started. Zone type follows Interface Type. Leaving Virtual Router empty commits — and black-holes L3.

         Cancel
         OK

    Click next:  IPv4 tab → Add the address → Advanced → Management Profile if you need ping → OK → repeat for ethernet1/8 zone  Internet  →  Commit . Source:  Configure Interfaces and Zones (PAN-OS) .

### Side B — virtual router and default route

- #### Confirm both interfaces are in VR default Network → Virtual Routers → default → Router Settings → General → Interfaces . Add ethernet1/8 and ethernet1/15 if the interface screen did not already attach them. Each Layer 3 Ethernet, loopback, VLAN, and tunnel interface must belong to exactly one VR.

- #### Add the default route Network → Virtual Routers → default → Static Routes → Add . Name to-internet . Destination 0.0.0.0/0 . Next Hop = IP Address 203.0.113.1 . Interface ethernet1/8. Official getting-started does this first so the internet IF has a way out.

- #### Leave PBF empty unless dest-IP is the wrong key If guest must exit a second ISP while corp uses this default route, that is Policies → Policy Based Forwarding , not a second default static. PBF Source Type = Zone or Interface; for Symmetric Return you must choose an interface. Forwarding tab: egress interface + next hop. Only Layer 3 interfaces — not loopback.

     https://fw.lab.example.com/#policies/security/add

     Training mock · not live

       Policies → Security → Add

### Security Policy Rule

         General
         Source
         Destination
         Application
         Service/URL
         Actions

           Name (General)
           allow-users-web-dns

           Source Zone
           Users

           Destination Zone
           Internet

           Service
           application-default

         Application
         dns, ssl, web-browsing

       Source Zone must be the zone on ethernet1/15. Destination Zone must be the zone on the egress IF the VR (or PBF) chose — here ethernet1/8 / Internet. A rule written trust → untrust will never see this session.

         Cancel
         OK

    Click next:  Actions → Allow + Security profile group + Log at Session End → OK →  Commit . Then prove in Monitor → Logs → Traffic. Source:  Set Up a Basic Security Policy  + this lesson’s zone rule.

### Side C — Security rule and proof

- #### Write the allow with the real zone names Policies → Security → Add . Source Zone Users . Destination Zone Internet . Application dns / ssl / web-browsing. Service application-default . Action Allow. Log at Session End. Commit. Deep rule craft is the Security policy lesson — this page only owns the zone match.

- #### Cable and check the Interfaces widget Official last steps: attach straight-through cables, then Dashboard → Interfaces widget is green. Then CLI:

   CLI · binding + route
 show interface all
show routing route
show running security-policy

   Green success

    show interface all  lists ethernet1/15 with zone  Users  and vr  default  (not blank).  show routing route  shows  0.0.0.0/0  via  203.0.113.1  on ethernet1/8. A user DNS query writes  Monitor → Logs → Traffic  with From Zone = Users, To Zone = Internet, inbound_if = ethernet1/15, outbound_if = ethernet1/8, Rule Name =  allow-users-web-dns . If Rule Name is  interzone-default , the zone pair on the rule is wrong — do not start by changing App-ID.

## 6. Runtime path after commit

 After go-live the packet does not “find the best rule.” It walks this path once.

- Frame arrives on an interface. Interface type decides whether the chassis will switch, route, pair, or only listen.

- Source zone is the zone configured on that ingress interface. If the IF has no zone, you do not have a Security match field.

- If the interface is Layer 3, the ingress VR runs a dest-IP lookup unless a PBF rule matched first. The result is an egress interface. Destination zone = zone on that egress interface.

- If the interface is vwire, the pair is the only legal exit. Destination zone is the zone on the other vwire port (or the same zone if you put both ports in one zone).

- If the interface is tap, there is no other side. Official tap rule: Source Zone = Destination Zone = the tap zone. Action Allow, profiles = alert.

- Security policy walks top-down. First rule whose zones (and other fields) match wins. No match → intrazone-default allow or interzone-default deny.

- Traffic log records From/To zone and inbound/outbound IF. Those four fields are the skeleton evidence.

   Proof · interface, zone, route healthy

   Close the ticket only when the Traffic log zone pair matches the doors you configured — not when Commit succeeded.

## 7. Traps + proof checklist

        Symptom  Likely miss  Prove / fix

         New allow never hits; log shows  interzone-default
         Rule Source/Dest zone names ≠ zones on the ingress/egress interfaces
         Compare Traffic log From/To Zone to  Network → Interfaces . Rename the rule zones or the IF zones so they are the same string.

         L3 IF is up, ping to the IF works, transit black-holes
         Virtual Router left empty
          show interface all  — vr column blank.  Network → Virtual Routers → default → Interfaces → Add .

         SOC expected blocks on a SPAN feed; malware still flows
         Tap cannot take action
         Official tap help: not in the flow. Move to vwire or L3 if you must drop. On tap, profiles = alert, same-zone allow only.

         Commit of new L3 on ethernet1/1 fails or traffic is hairpinned oddly
         Factory vwire still owns ethernet1/1–1/2
         Delete the default vwire, its zones, and its default Security rule, then Commit before rebuilding as L3.

         Guest and corp share dest 0.0.0.0/0; guest still uses ISP1
         You added a static on the same VR instead of PBF
         Dest-IP lookup cannot split by source.  Policies → Policy Based Forwarding  on the guest L3 ingress IF. Loopback cannot be a PBF source.

         HR VLAN can reach finance with no rule you wrote
         Both interfaces in the same zone →  intrazone-default  allow, logging off
         Split zones. Override  intrazone-default  to enable Log at Session End if you must keep one zone temporarily.

         Dual-WAN return drops / unexpected dest zone
         Outbound IF ≠ return IF; dest zone followed the unexpected egress
         Same zone on both WAN IFs, or PBF + Symmetric Return (source  interface ). Then re-check To Zone in the Traffic log.

   Pilot checklist

- Interface Type matches the zone type (Layer3 / Virtual Wire / Tap / Layer2).

- Every L3 Ethernet, VLAN, loopback, tunnel IF has a VR; show interface all vr column is filled.

- Security rule Source Zone = ingress IF zone; Dest Zone = egress IF zone (tap: both = tap zone).

- Factory vwire deleted if those ports were reused.

- Dashboard Interfaces widget green; Traffic log From/To + inbound_if/outbound_if match the design.

- PBF used only on L3, and only when dest-IP in the VR is the wrong key. Symmetric Return set from a source interface if return must pin.

## Knowledge check

   Six judgment items. Pick one answer each, then Check. Reasons name the section to re-read.

       Q1
       The customer will not re-IP either adjacent router. The NGFW must sit on that Ethernet segment and still drop malware. Which interface type?

           Tap, because no IP is assigned
           Virtual wire — pair two ports, no MAC/IP, policy still enforces
           Layer 3 with a /32 so nobody has to change a gateway
           Loopback, then PBF the transit traffic onto it

       Correct:  b . Official vwire help: insert without assigning MAC or IP; policy still runs. Tap cannot drop. L3 requires a gateway change. Loopback does not support PBF. Re-read Decision flow.

       Q2
       ethernet1/15 is in zone  Users . You committed  allow-trust-web  with Source Zone  trust , Dest Zone  untrust . The Traffic log (after you override logging) shows  interzone-default . What is wrong?

           The Security rule zone names are not the zones on the ingress/egress interfaces
           You must attach a second virtual router named trust
           App-ID cannot match until the zone is lowercase
           PBF is mandatory on every L3 allow

       Correct:  a . Rules match zone strings, not “the inside port.” Source zone is the zone on the ingress IF. Re-read Why + Side C.

       Q3
       A tap interface is cabled to a switch SPAN. The SOC attaches Vulnerability Protection with action reset-both. Why do infections still complete?

           SPAN copies are Layer 2 only, so App-ID never runs
           You forgot to put the tap interface in a virtual router
           Tap is not in the forwarding path — the firewall can alert, not block or reset the live flow
           Reset-both only works on interzone tap rules

       Correct:  c . Official tap help: not in the flow; cannot block or apply QoS. Set profile actions to alert. Re-read How to choose + traps.

       Q4
       ethernet1/15 is Layer3, has  192.168.1.4/24 , zone  Users , link is up. Hosts cannot leave the subnet.  show interface all  shows the vr column empty. First fix?

           Convert the interface to virtual wire so it does not need a route
           Add a PBF rule with next hop set to the zone name
           Delete interzone-default — it is blocking the connected route
           Attach the interface to a virtual router (Network → Virtual Routers → default → Interfaces)

       Correct:  d . Every L3 Ethernet/VLAN/loopback/tunnel IF must belong to a VR. The GUI will commit without one. Re-read mental model + Side B.

       Q5
       Corp and guest share dest  0.0.0.0/0 . Guest must exit ISP2; corp stays on the VR default route via ISP1. What does PAN-OS tell you to use?

           A PBF rule on the guest Layer 3 ingress that pins the ISP2 egress — dest-IP lookup cannot split by source
           A second virtual router named guest with no interfaces, because RIB names must match zones
           Tap on ISP2 so guest is only monitored
           PBF sourced from a loopback so both ISPs see a stable next hop

       Correct:  a . Official PBF: override the VR dest-IP lookup using source zone/interface, address, user, app, or service. Loopbacks do not support PBF. Re-read VR vs PBF.

       Q6
       You are writing the Security rule for a tap interface in zone  TapZone . What must be true?

           Source Zone TapZone, Destination Zone untrust — dest zone is always the internet
           Source Zone and Destination Zone are both TapZone; action Allow; threat profiles set to alert
           No Security rule is required because tap bypasses policy
           Destination Zone is taken from VR default after a route lookup

       Correct:  b . Official tap procedure: same tap zone on Source and Destination, Allow, profiles alert, Log at Session End, place the rule at the top. Re-read How to choose + Side C.

       Check answers
       Reset

## Sources

- Configure Interfaces and Zones — Network → Interfaces; Interface Type Layer3; Config tab New Zone + Virtual Router default ; official example IPs; delete factory vwire first; Dashboard Interfaces widget.

- Configure Layer 3 Interfaces — Layer3 type, VR attachment, then static/dynamic routing.

- Virtual Wire Interfaces — bind two ports, no MAC/IP, bump in the wire, still policy; factory ethernet1/1–1/2; VLAN tag 0 = untagged; no Interface Management profile.

- Tap Interfaces — SPAN/mirror; cannot block or QoS; New Zone; Security rule same tap zone both sides; profile action alert.

- Configure Virtual Routers — RIB → FIB; dest zone from outgoing IF; each L3 Ethernet/VLAN/loopback/tunnel in exactly one VR; default AD values; next-vr is one hop.

- Policy-Based Forwarding — overrides dest-IP VR lookup; L3 only; loopback unsupported; Symmetric Return needs a source interface.

- Policies → Policy Based Forwarding — ingress VR normally picks outgoing IF and dest zone; PBF can use source zone, address, user, dest, app, service.

- Traffic Log Fields — Source/Destination Zone, inbound_if, outbound_if, Rule Name.

 Related:  PAN-OS Security policy — first match, then prove it  ·  PBF and multi-VR  ·  Static, OSPF, BGP  ·  NAT deep dive  ·  Session factory  ·  Traffic not passing  ·  Palo Alto interview hub  ·  Palo Alto course

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt