>
    Strata Copilot
    Layer 2 Switch Interface
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. PAN-OS Web Interface Help
    4. Network
    5. Network > Interfaces
    6. Layer 2 Switch Interface
    Download PDF
    Next-Generation Firewall

    Layer 2 Switch Interface

    Table of Contents

    Layer 2 Switch Interface

    • Network > Interfaces > Ethernet
    Beginning with PAN-OS 12.2.2 release, PAN-OS next-generation firewalls support Layer 2 Switch interface type along with the existing interface types such as Layer 2 and Layer 3. When you need to consolidate your network infrastructure, the Layer 2 Switching feature on Next-Generation Firewalls allows you to operate your firewall as a fully functional Layer 2 switch. By assigning ports to the new Layer2 Switch interface type, you can perform high-speed, low-latency switching directly at the hardware switch ASIC level rather than routing intra-VLAN traffic through the software CPU. This feature introduces comprehensive switching capabilities directly on the firewall, enabling you to configure access and trunk VLANs per port, deploy Multiple Instance Spanning Tree Protocol (MSTP) for robust loop avoidance, utilize Link Aggregation (LAG), and apply Storm Control to mitigate excess broadcast, unknown unicast, and multicast traffic.
    Select NetworkInterfacesEthernet to configure a Layer 2 Switch interface. Select the name of an Interface (ethernet1/1, for example) that is not configured and specify the following information:
    FieldConfigured InDescription
    Interface Name
    		Ethernet InterfaceThe interface name is predefined and you cannot change it.
    Comment
    		(Optional) Enter a description for the interface.
    Interface Type
    		Select Layer2 Switch to enable layer 2 traffic switching on the device.
    Port Type
    Select Access to configure an access port, or Trunk to configure a trunk port.
    • Access Port Type—An access port supports the configuration of untagged frames within a single VLAN. When setting up this port type, you can configure the associated access VLAN tag.
    • Trunk Port Type—A trunk port supports the configuration of one or more VLANs on a single port. The different VLANs within a trunk port are represented by sub-interfaces, allowing you to configure one VLAN tag for each sub-interface. Additionally, you can specify a Native VLAN on the parent interface to handle incoming untagged packets on that trunk port.
    Access VLAN Tag
    		Ethernet InterfaceConfig
    (Access Ports Only) (Mandatory) Specify the 802.1q VLAN tag associated with a Layer 2 Switch interface that is configured as an Access port. You must enter a single VLAN ID, as ranges are not supported.
    The default value is 1.
    Native VLAN
    		(Trunk Ports Only) (Mandatory) Specifies a single VLAN ID to handle incoming/ingress untagged packets on a trunk port. It defaults to VLAN 1. By default, outgoing packets in the native VLAN are sent untagged; however, this behavior can be changed to send them tagged by enabling the Tagged Native VLAN option.
    Tagged Native VLAN
    (Trunk Ports Only) Select this option to make the native VLAN function as a Port VLAN ID (PVID). This allows the trunk port to process incoming untagged packets while ensuring that all outgoing packets from the trunk port remain tagged.
    VLAN
    (Access and Trunk Ports) Select an existing VLAN object (or define a new one) to bind the Layer 2 switch interfaces or sub-interfaces among each other.
    Virtual System
    (Access and Trunk Ports) If the firewall supports multiple virtual systems and that capability is enabled, select a virtual system for the interface or click Virtual System to define a new vsys.
    Security Zone
    (Access and Trunk Ports) Select a security zone. When you specify a zone, Layer 2 switch traffic bypasses the switching ASIC; the interface performs switching in software and applies Zone-Based Forwarding (ZBFW) for lateral/east-west traffic.
    When the Security Zone is set to None, traffic is processed as it would be on a standard Layer 2 switch, without firewall inspection. In this mode, the port operates as a Layer 2 switch port for the associated VLAN.
    Interface Name
    		(Trunk Ports Only) Ethernet InterfaceVLANs (Trunk Ports Only) This is a read-only field that displays the predefined name of the physical interface you selected (such as ethernet1/1 or vlan). In the adjacent field, you enter a numeric suffix (such as 1 to 9,999) to identify the specific subinterface or VLAN interface being configured.
    VLAN ID (TAG)
    		(Trunk Ports Only) Specify the 802.1q VLAN tag (from 1 to 4,000) for your subinterface. When you configure a trunk port, you represent the different VLANs using sub-interfaces, and you must configure one VLAN tag for each sub-interface.
    Comment
    		(Optional) (Trunk Ports Only) Enter a user-friendly description for the interface or subinterface.
    VLAN
    		(Trunk Ports Only) Select an existing VLAN object (or define a new one). This VLAN object binds the Layer 2 switch interfaces and sub-interfaces among each other, and enables switching between them or routing through a VLAN interface.
    Zone
    		(Trunk Ports Only) Associate a specific security zone with your interface or subinterface using this field. When you specify a security zone, the interface performs software-level switching and applies Zone-Based Forwarding (ZBFW) to your traffic.
    Broadcast/Multicast/Unicast
    		Ethernet InterfaceStorm ControlConfigure the Rising Threshold percentage (0-100%) for each traffic type. Note that storm control is configured on the parent interface and is not available in the sub-interface configuration pane.
    Action
    		Define the action to be taken when the rising threshold is met:
    • Log—Drops the traffic and logs it in a system log message for a burst of drops over a period of time.
    • Error—Drops the traffic and brings the interface down, placing it in an Error-Disable state.
    • Drop—Drops the excess traffic when the rising threshold is exceeded.
    STP Port Profile
    		Ethernet InterfaceSTP Select a Spanning Tree Protocol (STP) or Multiple Spanning Tree Protocol (MSTP) profile to detect and prevent L2 loops.
    (Optional) Port Priority
    		Configure the STP priority for the specific port. Enter a multiplier value between 0 and 15; the actual priority is calculated as the entered value multiplied by 16. The default value is 8, which yields an actual priority of 128.
    (Optional) Port Path Cost
    Define the cost of the path for Spanning Tree calculations. Enter a value between 0 and 200,000,000. A value of 0 instructs STP to automatically calculate the cost based on link speed.
    Link Speed
    		Ethernet InterfaceAdvancedLink Settings Select the interface speed in Mbps, or select auto to have the firewall automatically determine the speed.
    Link Duplex
    		Select whether the interface transmission mode is fullduplex (full) or negotiated automatically (auto).
    Link State
    		Select whether the interface status is enabled (up), disabled (down), or determined automatically (auto).
    Enable LLDP
    		Ethernet InterfaceAdvancedLLDPSelect to enable Link Layer Discovery Protocol (LLDP) on the Layer 2 Switch interface.
    LLDP Profile
    		If LLDP is enabled, select an LLDP profile to assign to the interface for the transmission and receipt of LLDP packets.

    © 2026 Palo Alto Networks, Inc. All rights reserved.