Palo Alto Networks Certified Network Security Engineer (PCNSE)Deploy and ConfigureHard
A data center migration project requires replacing an older firewall with a new Palo Alto Networks firewall. The existing network infrastructure uses VLANs extensively, and the new firewall must integrate seamlessly without altering the Layer 2 network topology. The firewall will perform security inspection between different VLANs within the same physical interface. Which interface type is most appropriate for this scenario?
- ALayer 3 Interface
- BAggregate Ethernet Interface
- CSubinterface
- DVirtual Wire Interface
Show answer & explanationAnswer & explanation
Correct answer: C. Subinterface
When a physical interface needs to handle traffic for multiple VLANs and perform Layer 3 routing functions (security inspection between VLANs implies routing), subinterfaces are the most appropriate choice. Each subinterface is configured with a VLAN tag and an IP address, effectively creating multiple logical Layer 3 interfaces on a single physical port.
Why the other options are wrong
- A. A single Layer 3 Interface typically handles one IP subnet; it cannot directly handle multiple VLANs with different IP subnets on the same physical port for routing without subinterfaces.
- B. An Aggregate Ethernet Interface (LAG/LACP) bundles multiple physical interfaces for increased bandwidth and redundancy, but doesn't inherently solve the multi-VLAN routing problem on a single logical interface.
- D. A Virtual Wire Interface operates at Layer 2 and is used for transparently bridging segments without routing, which doesn't fit the requirement for inter-VLAN security inspection (routing).
Palo Alto Networks Subinterface
A subinterface is a logical interface associated with a physical interface, configured with a VLAN tag and an IP address to handle traffic for a specific VLAN.
- Enables a single physical port to route multiple VLANs.
- Each subinterface belongs to a security zone.
- Used for 'router-on-a-stick' scenarios on the firewall.
Memory trick: Interfaces: L3 for Route, VWire for Bridge, Sub for VLANs.