Configure a Layer 2 Interface

Log in to
Strata Cloud Manager
.
Select
Manage
Configuration
NGFW and Prisma Access
Device Settings
Interfaces
Ethernet
and select the Configuration Scope where you want to create the Layer 2 interface.
Select a firewall from your
Folders
or select
Snippets
to configure the Layer 2 interface in a snippet.
If you select a folder or select a snippet, you create a Layer 2 interface variable that must be assigned at the device level.
Add the interface.
If you’re configuring a Layer 2 interface for a specific firewall, select the interface you want to configure instead.
Folders and Snippets
—
Add Interface
and select
Interface
.
Firewalls
—
Add
and
Add Interface
.
Configure the interface.
If you’re configuring an interface in the folder or snippet scope, the interface configuration is pushed only to firewalls that have the corresponding interface slot available. For example, if you configure Ethernet 1/5 in the folder scope and the firewall associated with the folder has only four interface slots, then the configuration isn’t pushed to the firewall.
Select the interface
Slot
.
Select the
Interface Name
.
When you configure an interface for a specific firewall, the
Interface Name
is fixed, such as
ethernet1/1
if you select Slot 1. The fixed interface names are dependent on the slot that you selected in the previous step.
(
Folders and Snippets only
) Select the
Default Interface Assignment
.
(
Optional
) Enter a
Description
.
For
Interface Type
, select
Layer2
.
(
Folders and Snippets only, Optional
)
Assign Interface to VLAN Tag
to add the interface to a VLAN.
(
Folders and Snippets only; Recommended
) Assign the interface to a
Zone
.
Create New
to create a new zone. See Zone Protection and DoS Protection for more information.
(
Optional
) Configure the interface link settings.
Select the interface
Link Speed
.
Auto
is selected by default and allows the firewall to determine the speed.
Select the interface
Link Duplex
transmission mode.
Auto
is selected by default to allow the firewall to negotiate the transmission mode automatically.
Select the interface
Link State
.
Auto detect
is selected by default to allow the firewall to determine the link state.
Save
.
Create a Security policy rule to allow the traffic through the tap interface.
When creating a Security policy rule for a tap interface, both the source zone and destination zone must be the same.
Select
Manage
Configuration
Security Services
Security Policy
and
Add Ruke
.
For the Source,
Add Zones
and select the zone you created in the previous step.
For the Destination,
Add Zones
and select the zone you created in the previous step.
Set all of the Security policy rule match criteria (Applications, User, Service, Address) to
any
.
For the Action and Advanced Inspection, set the Action to
Allow
.
Expand the
Advanced Settings
and for the Log Settings, set Log at Session
End
.
Save
.
Push Config
to push your configuration changes.