The OSI Model: Where L2 & L3 Live
The OSI model has 7 layers. Firewalls primarily operate at Layer 2 and Layer 3 — but understanding where those layers sit changes everything. Hover over a layer to explore it.
Layer 2 moves data within a single network segment using MAC addresses. Layer 3 moves data between different networks using IP addresses. A firewall like Palo Alto can operate at either — or both — depending on how you configure it.
Layer 2 vs Layer 3 — Side by Side
These two layers work together but do very different jobs. Think of L2 as your neighborhood streets and L3 as the highway system connecting cities.
Layer 2 — Data Link
Layer 3 — Network
🎬 Interactive: Watch Traffic Flow
Palo Alto Interface Types
When you plug a cable into a Palo Alto firewall, you must tell it how that port should behave. Palo Alto supports four main interface types — click each to learn more.
Layer 2 Interface
L2 MODEActs like a switch port. Forwards traffic based on MAC addresses within the same broadcast domain.
- Assigned to a VLAN object on the PA
- Does NOT perform routing — no IP assigned to the port
- Supports 802.1Q VLAN tagging (trunk mode)
- Use when PA sits inside an existing switched network
- Security policy still applies — PA inspects traffic
- CLI:
set interface ethernet1/1 link-state auto
Layer 3 Interface
L3 MODEActs like a router interface. Has an IP address assigned and participates in routing decisions.
- Assigned an IP address and subnet mask
- Associated with a Virtual Router for route lookups
- Supports static routes, OSPF, BGP, RIP
- Most common interface type for firewalls
- Can have multiple sub-interfaces for VLANs
- Example: ethernet1/1 → 192.168.1.1/24
Virtual Wire (V-Wire)
TRANSPARENTBumps-in-the-wire mode. The firewall is invisible to the network — no IP, no routing, just inspection.
- Two interfaces paired together as a "wire"
- Traffic passes through transparently
- No IP address on interfaces — network unchanged
- Great for inserting PA into an existing network with no re-IP
- Still enforces security policy and inspects all traffic
- Cannot route between different IP subnets
Tap Interface
MONITOR ONLYPassive monitoring mode. Receives a copy of traffic from a switch SPAN port — can't block anything.
- Receives mirrored traffic from a switch SPAN/mirror port
- Read-only — cannot block or modify traffic
- Used for traffic analysis, logging, and visibility
- Great for pilot testing before going inline
- Security policy applied for logging only, not enforcement
- No IP address required on the tap interface
L3 is the most common production deployment. L2 is used when you can't change IP addressing. V-Wire is the easiest way to insert a firewall with zero network changes. Tap is for learning and assessment only.
Traffic Flow Through a Palo Alto Firewall
Every packet that enters the PA firewall goes through a specific sequence of processing steps. Understanding this flow is critical for troubleshooting.
192.168.1.100
MAC lookup / IP recv
Untrust zone
src zone → dst zone
match in route table
Build new L2 frame
10.0.0.50
At Step 5, even though the L3 destination IP hasn't changed, the firewall must build a brand new L2 frame with the next-hop router's MAC address. This is how L2 and L3 work together — L3 handles the end-to-end path, L2 handles each individual hop.
Virtual Routers & Routing Tables
Palo Alto uses "Virtual Routers" — software routers inside the firewall. Each has its own routing table. You can have multiple virtual routers for traffic separation.
📍 Sample Routing Table
This is what a Virtual Router's routing table looks like. The PA matches the destination IP against these routes — longest prefix wins.
| Destination | Next Hop | Type |
|---|---|---|
| 10.0.0.0/8 | 10.1.1.1 | Static |
| 192.168.1.0/24 | — | Connected |
| 172.16.0.0/12 | 172.16.0.1 | OSPF |
| 0.0.0.0/0 | 203.0.113.1 | Default |
🔄 Routing Protocols Supported
Palo Alto Virtual Routers support multiple routing protocols for dynamic route learning.
Static Routes
Manually configured routes. Best for simple networks or specific traffic paths. Always wins over dynamic routes when admin distance is equal.
OSPF (Open Shortest Path First)
Link-state protocol. PA learns routes from neighboring routers automatically. Great for internal corporate networks.
BGP (Border Gateway Protocol)
The internet's routing protocol. Used for ISP connections and large-scale enterprise routing. PA supports eBGP and iBGP.
RIP (Routing Information Protocol)
Distance-vector protocol. Older and simpler. Not recommended for new deployments but supported for compatibility.
If a packet is destined for 10.5.6.7, and your route table has both 0.0.0.0/0 and 10.0.0.0/8, the PA picks 10.0.0.0/8 because /8 is more specific (longer prefix) than /0. The more specific the route, the higher the priority.
Security Zones — The Palo Alto Secret Sauce
Zones are what make Palo Alto unique. Every interface belongs to a zone. Security policy is written between zones — not between interfaces or IPs. This makes rules clean and scalable.
Trust
Internal users & servers. Usually protected from the outside world.
ethernet1/2Untrust
The internet — unknown, potentially hostile traffic. Usually the WAN/ISP link.
ethernet1/1DMZ
Public-facing servers (web, email). Partially trusted — isolated from internal.
ethernet1/3Management
Firewall management plane. Dedicated out-of-band access for admins only.
mgmtHow Zone-Based Policy Works
Traffic is allowed or denied based on the source zone and destination zone. Intrazone traffic (within the same zone) is allowed by default. Interzone traffic (different zones) is denied by default until you create a rule.
App: web-browsing
Action: Allow
An interface is the physical or logical port on the firewall. A zone is a logical grouping of interfaces. One zone can contain multiple interfaces, but one interface can only belong to one zone. You write security rules using zone names — so if you add a new interface to an existing zone, all rules automatically apply to it.
Beginner's Cheat Sheet
Keep these terms and concepts in your back pocket as you start configuring Palo Alto firewalls.