>
    Strata Copilot
    Configure a Loopback Interface
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma SD-WAN
    3. Prisma SD-WAN Administrator’s Guide
    4. Prisma SD-WAN Sites and Devices
    5. Prisma SD-WAN Ports and Interfaces
    6. Configure a Loopback Interface
    Download PDF
    Prisma SD-WAN

    Configure a Loopback Interface

    Table of Contents

    Configure a Loopback Interface

    Lets learn about the Loopback interfaces in Prisma SD-WAN.
    Use CasesPrerequisites
    • Prisma SD-WAN (Managed by Strata Cloud Manager)
    • Prisma SD-WAN
    A loopback interface is a logical, virtual interface on an ION device. Unlike physical ports, a loopback interface remains up regardless of physical port state, making it ideal for stable management access, overlay services, and freeing up physical ports for other uses. Prisma® SD- WAN supports two types of loopback interfaces:
    Configure a Layer 2 Loopback Interface
    Purpose
    Use an L2 loopback interface to emulate a WAN port and free up a physical port previously used for LAN/WAN configuration. An L2 loopback interface enables you to create a bypass pair with a physical LAN port.
    Requirements
    All currently supported software versions support Layer 2 loopback interfaces. A Layer 2 loopback interface can only be used as a WAN port on interfaces with no hardware bypass circuitry. For details on which ports do not have bypass circuitry on each device, refer to the hardware specifications for your ION Device.
    Limitations
    • A Layer 2 loopback interface may be brought up or down administratively. It cannot contain sub-interfaces or IP configurations.
    • You can configure a maximum of four Layer 2 loopback interfaces per device.
    • You can update or delete a loopback interface. However, you cannot delete it if it is part of a bypass pair.
    • Decouple a port coupled with another port before a loopback interface can be coupled to create a bypass pair.
    • The only valid option in the Use These Ports For drop-down is Private Layer 2 for a bypass pair that is made up of a physical LAN port and a loopback interface as the WAN port.
    • The network policy rules assigned to such a site must not have any rules using the Direct on private WAN path. Valid paths are Direct on public or VPN on public. Traffic is dropped if a direct on private path is used.
    1. To configure the device interface, go to ConfigurationPrisma SD-WANBranch SiteDevices Interface and select the device you want to configure.
    2. To configure the device interface, go to ConfigurationPrisma SD-WANION Devices [Device Name]Configure Device Interface and select the device you want to configure.
    3. On the device's interface configuration page, select the Interfaces+ Add Interface to add icon to add a loopback interface.
    4. In the General section, select L2 as the Loopback Interface.
      1. Enter a Name, Tags, and Description.
      2. For Admin Up, select Yes or No to administratively bring the interface up or down. The default is Yes.
      The L2 loopback interface has now been created (Steps 3–4). The following substeps configure a physical port to form a bypass pair with the loopback. To do this, navigate back to the Interfaces page, select the physical port you want to pair, and configure it as described below.
    5. On the Interfaces page, select the physical port you want to pair with the loopback interface. In the Network Setting section,
      1. Select Bypass Pair as the Interface Type.
      2. From the Pair With drop-down, select the Loopback Interface.
        Verify that the confirmation message appears.
      3. Select Done to create a bypass pair with the loopback interface successfully.
        Verify that the confirmation message appears confirming the port's successful creation and the loopback interface.
      4. For Use These Ports For, select Private L2 from the drop-down.
        This is the only valid option for a bypass pair that is made of a physical LAN port and a loopback interface for the WAN port.
        To configure a bypass pair using a physical interface and an L2 loopback interface, Enable L3 Direct Private WAN Forwarding must be turned off under Basic Info. If Enable L3 Direct Private WAN Forwarding is enabled, the Private L2 option will be grayed out.
      5. For Security Zone, select a device to bind.
      6. Choose a Circuit Label.
      7. Similar to configuring bypass pairs, for Attached Networks, enter a VLAN ID, IP Address at Router, optional Network Context, and toggle the scope tp Local or Global scope.
      8. Save Bypass Pair.
        The system assigns a default loopback ID to the interface. Verify that the confirmation message shows the loopback interface was successfully created. Verify that the port and the loopback interface appear under Interfaces.

    Configure a Layer 3 Loopback Interface

    Purpose
    Prisma SD-WAN supports Layer 3 capabilities on loopback interfaces for SSH, SNMP, and Syslog services on branch and data center ION devices. An L3 loopback interface remains up regardless of physical port state, enabling stable management, routing protocol peering, and SD-WAN VPN tunnel establishment.
    Requirements
    The layer 3 capabilities on loopback interfaces are supported from the device release 6.5.2 and above. Custom VRF support for L3 loopback interfaces requires device release 6.8.1 and above.
    Prisma SD-WAN supports a maximum of 12 loopback interfaces per ION device on all ION devices and virtual ION platforms.
    You can configure L3 loopback interfaces in both the Default VRF and Custom VRFs. VRF support depends on the loopback interface type:
    • LAN-side loopback interface (used for LAN connectivity or peering with a network) — supported in both the Default VRF and Custom VRFs.
    • WAN-side loopback interface (used for Private WAN, Internet, or Connect to Internet) — supported in the Default VRF only.
    Limitations
    • L3 loopback interfaces support only the /32 subnet mask.
    • L3 loopback interfaces do not support IPv6.
    • You cannot use a loopback interface to establish a Standard VPN tunnel.
    • WAN-side loopback interfaces support the Default VRF only.
    Use Cases
    Use Case 1: L3 Loopback Interfaces for Management and Troubleshooting
    Service Providers use L3 loopback interfaces on managed network devices for troubleshooting tasks and management operations. As an example a loopback IP interface can be used for SSH to the device or for Syslog services. An L3 loopback interface on the ION device allows management operations via the overlay. As a result, you do not have to rely on LAN interfaces, which are part of the infrastructure, or on WAN interfaces which involve using the underlay leading to potential security considerations.
    • In this example, the ION device loopback interface is configured with the IP address 192.168.1.1/32.
    • BGP sessions are running between ION eth1 and R1 and ION eth1 and R2. Both the BGP sessions advertise the loopback interface IP address to the routers R1 and R2.
    • Users can configure the loopback interface as a source interface in services such as Syslog.
    • The Syslog packet generated in the ION device will use the loopback IP address which will go out through eth1 to R1 and then to the Syslog server.
    • Using a loopback interface masks the physical interface IP address and status.
    Use Case 2: Loopback Interface for Establishing VPN Tunnels
    You can establish Prisma SD-WAN tunnels using the loopback interface when the MPLS WAN IP interfaces cannot be routed through the network.
    In the example above, the Internet Service Provider (ISP) has provided an IP address to an interface (the associate interface) and the Prisma SD-WAN VPN tunnel is formed over the loopback interface.
    • You can configure an L3 Loopback interface with used for = public or private for branch ION devices, and used for = public and peer with network for data center ION devices.
    • To associate the interface, see the steps for configuring a Layer 3 loopback interface.
    • The VPN is formed over the loopback interface IP address.
    • The peer should be able to reach the loopback IP address via the associated interface to form a VPN tunnel.
    • You cannot use a loopback Interface to establish a Standard VPN tunnel.
    Layer 3 Loopback Interface Overview
    1. To configure the device interface, go to ConfigurationPrisma SD-WANBranch SiteDevices Interface and select the device you want to configure.
    2. To configure the device interface, go to ConfigurationPrisma SD-WANION Devices [Device Name]Configure Device Interface and select the device you want to configure.
    3. On the device's interface configuration page, select the Interfaces+ Add Interface to add a loopback interface.
    4. In the General section, select L3 as the Loopback Interface.
      1. Enter a Name, Description, and optionally Tags.
      2. For Admin Up, select Yes or No to administratively bring the interface up or down. The default is Yes.
      3. For Interface Type, confirm the loopback type is set to L3.
      4. For Security Zone, select the security zone to associate with this loopback interface.
    5. In the Network Setting section,
      1. Select either Internet, Private WAN, or LAN for Use this port for on the Branch and select either Connect to Internet or Peer with a Network on the DC.
      2. Attach a Circuit Label when Use this port for is set to Internet, Private WAN on Branch and is set to Connect to Internet on DC.
      3. For VRF, select the VRF to associate with the loopback interface.
        • LAN-side loopbacks support Default VRF and Custom VRFs.
        • WAN-side loopbacks support Default VRF only.
      4. For Associate Interface, enter the interface through which the loopback interface can send traffic.
        Associate Interface conditionality:
        • For WAN or tunnel use cases (Internet, Private WAN) on both Branch and DC: Associate Interface is required to route loopback traffic out of the device.
        • For Branch LAN-side such as Management or BGP: Associate Interface is not required.
        • For DC ION devices with Use this port for set to Peer with Network: Associate Interface is available as an option.
        • You can use a port or a sub-interface as an Associate interface.
        • You can use an interface as an Associate Interface only if it does not have a circuit label already attached.
        • Ensure that you advertise the loopback IP Address only on the Associate Interface.
        • VPN tunnels will be established only over the Associate Interface on the underlay.
        • If NAT is configured on the associated interface, the loopback IP address will be NATted to the associated interface IP address.
      5. Set Scope to Global for advertising the Loopback Interface IP address to BGP peers.
        When configured as global, the loopback prefix will be advertised to all BGP peers.
      6. For IP Address Mask, enter the /32 IP address.
        • Loopback supports only the /32 subnet mask.
        • Loopback does not support IPv6.
      7. Select Create loopback.

    Routing Protocols with L3 Loopback Interfaces

    Prisma SD-WAN supports two distinct BGP capabilities with L3 loopback interfaces:
    Advertising the loopback IP prefix to BGP peers: You can advertise the loopback interface IP address as a /32 prefix to BGP peers by setting Scope to Global. When configured as Global, the loopback prefix is advertised to all BGP peers and to the fabric.
    BGP peering using a loopback as the update source: You can establish a BGP peering session using a loopback interface as the update source.
    The following constraints apply: Peer reachability must exist within the same VRF.
    • LAN-side BGP peering using a loopback as the update source is supported in both the Default VRF and Custom VRFs.
    • WAN-side BGP peering using a loopback as the update source is supported in the Default VRF only.
    Version requirement: Requires device release 6.8.1 and above.
    OSPF with L3 Loopback Interfaces
    Prisma SD-WAN also supports OSPF with L3 loopback interfaces. You can use an L3 loopback interface as the OSPF router ID and as a source interface for OSPF adjacencies, providing a stable identifier that remains up regardless of physical port state.
    • OSPF supports using L3 loopback interfaces as the router ID.
    • OSPF adjacencies can be sourced from an L3 loopback interface for more stable neighbor relationships.
    • LAN-side OSPF peering using a loopback as the source is supported in both the Default VRF and Custom VRFs.
    • WAN-side OSPF peering using a loopback interface is not supported. OSPF is not supported on the WAN side in Prisma SD-WAN.

    © 2026 Palo Alto Networks, Inc. All rights reserved.