🔥 Palo Alto Networks

Firewall Routing 101

Understanding Layer 2 & Layer 3 networking for beginning firewall engineers — with Palo Alto as your guide.

Layer 2 — Data Link Layer 3 — Network Palo Alto NGFW

The OSI Model: Where L2 & L3 Live

The OSI model has 7 layers. Firewalls primarily operate at Layer 2 and Layer 3 — but understanding where those layers sit changes everything. Hover over a layer to explore it.

7
Application
HTTP, DNS, SMTP
6
Presentation
TLS/SSL, encoding
5
Session
Session management
4
Transport
TCP, UDP, ports
3
Network ★ L3
IP addresses, routing
2
Data Link ★ L2
MAC addresses, VLANs, frames
1
Physical
Cables, fiber, signals
💡
The Key Insight for Beginners

Layer 2 moves data within a single network segment using MAC addresses. Layer 3 moves data between different networks using IP addresses. A firewall like Palo Alto can operate at either — or both — depending on how you configure it.


Layer 2 vs Layer 3 — Side by Side

These two layers work together but do very different jobs. Think of L2 as your neighborhood streets and L3 as the highway system connecting cities.

Layer 2 — Data Link

Traffic within the same network segment
📬
Addressing: MAC Address A hardware address burned into every network interface card (NIC). 48-bit, written in hex.
📦
Data Unit: Frame L2 wraps data in a "frame" that includes source & destination MAC addresses.
🔀
Device: Switch / Bridge L2 devices forward frames based on MAC address tables. No IP knowledge needed.
📡
Scope: Broadcast Domain All devices on the same L2 segment can talk directly. VLANs create separate broadcast domains.
Example MAC Address
00:1A:2B:3C:4D:5E
00:1A:2B + 3C:4D:5E
First 3 bytes = OUI (Vendor) · Last 3 bytes = Device ID

Layer 3 — Network

Traffic between different network segments
🗺️
Addressing: IP Address A logical address assigned to interfaces. IPv4 is 32-bit (e.g., 192.168.1.1). IPv6 is 128-bit.
📮
Data Unit: Packet L3 wraps data in a "packet" that includes source & destination IP addresses.
🧭
Device: Router / L3 Switch L3 devices look up the destination IP in a routing table and forward packets hop-by-hop.
🌐
Scope: Between Networks L3 routing connects different subnets — e.g., 192.168.1.0/24 talking to 10.0.0.0/8.
Example IPv4 Address with Subnet
192.168.1.100/24
192.168.1 . 100 /24
Network: 192.168.1.0 · Hosts: .1–.254 · Broadcast: .255

🎬 Interactive: Watch Traffic Flow

L2 FRAME
MAC
Source MAC: 00:1A:2B:3C:4D:5E Destination MAC: FF:FF:FF:FF:FF:FF (broadcast)
L3 PACKET
IP
Source IP: 192.168.1.100 Destination IP: 10.0.0.50
Click "Send Packets" to see L2 frames and L3 packets in action.

Palo Alto Interface Types

When you plug a cable into a Palo Alto firewall, you must tell it how that port should behave. Palo Alto supports four main interface types — click each to learn more.

🔗

Layer 2 Interface

L2 MODE

Acts like a switch port. Forwards traffic based on MAC addresses within the same broadcast domain.

  • Assigned to a VLAN object on the PA
  • Does NOT perform routing — no IP assigned to the port
  • Supports 802.1Q VLAN tagging (trunk mode)
  • Use when PA sits inside an existing switched network
  • Security policy still applies — PA inspects traffic
  • CLI: set interface ethernet1/1 link-state auto
🌐

Layer 3 Interface

L3 MODE

Acts like a router interface. Has an IP address assigned and participates in routing decisions.

  • Assigned an IP address and subnet mask
  • Associated with a Virtual Router for route lookups
  • Supports static routes, OSPF, BGP, RIP
  • Most common interface type for firewalls
  • Can have multiple sub-interfaces for VLANs
  • Example: ethernet1/1 → 192.168.1.1/24
🔄

Virtual Wire (V-Wire)

TRANSPARENT

Bumps-in-the-wire mode. The firewall is invisible to the network — no IP, no routing, just inspection.

  • Two interfaces paired together as a "wire"
  • Traffic passes through transparently
  • No IP address on interfaces — network unchanged
  • Great for inserting PA into an existing network with no re-IP
  • Still enforces security policy and inspects all traffic
  • Cannot route between different IP subnets
👁️

Tap Interface

MONITOR ONLY

Passive monitoring mode. Receives a copy of traffic from a switch SPAN port — can't block anything.

  • Receives mirrored traffic from a switch SPAN/mirror port
  • Read-only — cannot block or modify traffic
  • Used for traffic analysis, logging, and visibility
  • Great for pilot testing before going inline
  • Security policy applied for logging only, not enforcement
  • No IP address required on the tap interface
When to Use Which Mode?

L3 is the most common production deployment. L2 is used when you can't change IP addressing. V-Wire is the easiest way to insert a firewall with zero network changes. Tap is for learning and assessment only.


Traffic Flow Through a Palo Alto Firewall

Every packet that enters the PA firewall goes through a specific sequence of processing steps. Understanding this flow is critical for troubleshooting.

0
🖥️ Source Device Generates traffic
e.g., User laptop
192.168.1.100
1
🔌 Ingress Interface L2 or L3 port
Packet arrives
MAC lookup / IP recv
2
🛡️ Security Zone Classify traffic
e.g., Trust zone
Untrust zone
3
📋 Security Policy Allow / Deny?
Match rule:
src zone → dst zone
4
🧭 Virtual Router Route lookup (L3)
Longest prefix
match in route table
5
🔌 Egress Interface Outbound port
ARP for next hop
Build new L2 frame
6
🖥️ Destination Traffic delivered
e.g., Server
10.0.0.50
⚠️
The Critical L2/L3 Handoff

At Step 5, even though the L3 destination IP hasn't changed, the firewall must build a brand new L2 frame with the next-hop router's MAC address. This is how L2 and L3 work together — L3 handles the end-to-end path, L2 handles each individual hop.


Virtual Routers & Routing Tables

Palo Alto uses "Virtual Routers" — software routers inside the firewall. Each has its own routing table. You can have multiple virtual routers for traffic separation.

📍 Sample Routing Table

This is what a Virtual Router's routing table looks like. The PA matches the destination IP against these routes — longest prefix wins.

Destination Next Hop Type
10.0.0.0/8 10.1.1.1 Static
192.168.1.0/24 Connected
172.16.0.0/12 172.16.0.1 OSPF
0.0.0.0/0 203.0.113.1 Default
💡 Connected routes are added automatically when you assign an IP to an L3 interface.

🔄 Routing Protocols Supported

Palo Alto Virtual Routers support multiple routing protocols for dynamic route learning.

📌
Static Routes

Manually configured routes. Best for simple networks or specific traffic paths. Always wins over dynamic routes when admin distance is equal.

🕸️
OSPF (Open Shortest Path First)

Link-state protocol. PA learns routes from neighboring routers automatically. Great for internal corporate networks.

🌍
BGP (Border Gateway Protocol)

The internet's routing protocol. Used for ISP connections and large-scale enterprise routing. PA supports eBGP and iBGP.

📡
RIP (Routing Information Protocol)

Distance-vector protocol. Older and simpler. Not recommended for new deployments but supported for compatibility.

🔍
How Longest Prefix Match Works

If a packet is destined for 10.5.6.7, and your route table has both 0.0.0.0/0 and 10.0.0.0/8, the PA picks 10.0.0.0/8 because /8 is more specific (longer prefix) than /0. The more specific the route, the higher the priority.


Security Zones — The Palo Alto Secret Sauce

Zones are what make Palo Alto unique. Every interface belongs to a zone. Security policy is written between zones — not between interfaces or IPs. This makes rules clean and scalable.

🏢

Trust

Internal users & servers. Usually protected from the outside world.

ethernet1/2
🌐

Untrust

The internet — unknown, potentially hostile traffic. Usually the WAN/ISP link.

ethernet1/1
🖥️

DMZ

Public-facing servers (web, email). Partially trusted — isolated from internal.

ethernet1/3
⚙️

Management

Firewall management plane. Dedicated out-of-band access for admins only.

mgmt

How Zone-Based Policy Works

Traffic is allowed or denied based on the source zone and destination zone. Intrazone traffic (within the same zone) is allowed by default. Interzone traffic (different zones) is denied by default until you create a rule.

🌐 Untrust Zone
📋 Security Policy
Rule: Untrust → Trust
App: web-browsing
Action: Allow
🏢 Trust Zone
💡
Zone vs. Interface — What's the Difference?

An interface is the physical or logical port on the firewall. A zone is a logical grouping of interfaces. One zone can contain multiple interfaces, but one interface can only belong to one zone. You write security rules using zone names — so if you add a new interface to an existing zone, all rules automatically apply to it.


Beginner's Cheat Sheet

Keep these terms and concepts in your back pocket as you start configuring Palo Alto firewalls.

Layer 2 Terms

MAC Media Access Control — hardware address of a network card. Never changes (usually).
Frame L2 data unit. Contains source MAC, destination MAC, and the payload.
VLAN Virtual LAN — logical segmentation of a L2 network. Uses 802.1Q tags.
ARP Address Resolution Protocol — maps an IP address to a MAC address within a segment.
Trunk A switch port that carries multiple VLANs using 802.1Q tags.

Layer 3 Terms

IP Internet Protocol — logical address for routing. IPv4: 32-bit, IPv6: 128-bit.
Subnet A block of IP addresses. e.g., 192.168.1.0/24 = 254 usable hosts.
Route An entry in the routing table telling the firewall where to forward packets.
Hop Each router a packet passes through on its way to the destination.
NAT Network Address Translation — rewrites IP addresses. Used to share one public IP.

Palo Alto Terms

Zone Logical grouping of interfaces. Security policy is written between zones.
VR Virtual Router — software router inside the PA. Holds routes and routing protocols.
Vsys Virtual System — logical separation inside a PA. Like multiple firewalls in one box.
NGFW Next-Generation Firewall — identifies apps, users, and content, not just ports.
App-ID Palo Alto technology that identifies applications regardless of port or protocol.