>
    Strata Copilot
    PAN-OS & Panorama
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. Configure Interfaces
    4. Cellular Interfaces
    5. Configure Multiple APN and DNN Sessions
    6. PAN-OS & Panorama
    Download PDF
    Next-Generation Firewall

    PAN-OS & Panorama

    Table of Contents

    PAN-OS & Panorama

    On PAN-OS or Panorama, configure APN and DNN cellular subinterfaces on a 5G-integrated firewall.
    APN and DNN profiles are centrally managed under NetworkNetwork ProfilesCellularAPN/DNN Profile. You create a profile there and then assign it to the parent cellular interface or to individual subinterfaces. Subinterfaces inherit advanced cellular settings from the parent interface (exceptions are radio band preferences, GPS, DHCP relay, and SIM configuration). You configure each subinterface's security zone, virtual or logical router, and other configuration parameters independently. For example, you can use policy-based forwarding (PBF) to steer traffic to the appropriate subinterface based on source address, destination address, port, or application. In Panorama, APN/DNN profiles are available under TemplatesNetworkNetwork ProfilesCellularAPN/DNN Profile and push to managed firewalls through the standard template mechanism. Committing a multiple APN or DNN configuration does not require a firewall reboot.

    Configure Multiple APNs

    Create APN profiles and assign them to cellular subinterfaces to run multiple 4G LTE data sessions simultaneously on the same firewall. Each subinterface carries a separate APN connection with independent IP addressing and routing.
    1. Create one or more APN profiles.
      1. Select NetworkNetwork ProfilesCellularAPN/DNN Profile and click Add.
      2. For Type, choose APN.
      3. Enter a Profile Name and the APN Name as provided by your carrier.
      4. (Optional) Select a PDP Type and configure Authentication Type with credentials if your carrier requires authentication.
      5. Click OK and repeat for each additional APN.
    2. Select NetworkInterfacesCellular and select the cellular interface you want to configure.
    3. On the parent interface, assign the primary APN profile to the appropriate SIM slot and click OK.
    4. Add cellular subinterfaces for each additional APN session.
      1. On the Subinterfaces tab, click Add.
      2. Enter a unit number: 1–7 for SIM slot 1 sessions, or 8–14 for SIM slot 2 sessions.
      3. Choose the SIM Slot that corresponds to the unit number range.
      4. For APN/DNN Profile, choose the APN profile to assign to this subinterface.
      5. Click OK and repeat for each additional subinterface.
    5. For each subinterface, configure the Security Zone and Virtual Router settings on the IPv4 tab.
    6. Configure policy-based forwarding (PBF) rules to steer traffic to the appropriate APN subinterface based on source address, destination address, port, or application.
    7. Commit.
      A reboot is not required after committing APN subinterface configurations.

    Configure Multiple DNNs

    Create DNN profiles and assign them to cellular subinterfaces to run multiple 5G SA data sessions simultaneously. For network slicing deployments, configure S-NSSAI values on each DNN profile to map sessions to specific 5G network slices before assigning the profiles to subinterfaces.
    1. Create one or more DNN profiles.
      1. Select NetworkNetwork ProfilesCellularAPN/DNN Profile and click Add.
      2. For Type, choose DNN.
      3. Enter a Profile Name and the DNN Name as provided by your carrier.
      4. (Optional) Select a PDP Type and configure Authentication Type with credentials if your carrier requires authentication.
      5. (Optional) For network slicing, enter the Slice/Service Type (SST) value in the range 0–255, and enter the Slice Differentiator (SD) if your carrier requires it.
      6. Click OK and repeat for each additional DNN.
    2. Select NetworkInterfacesCellular and select the cellular interface you want to configure.
    3. On the parent interface, assign the primary DNN profile to the appropriate SIM slot and click OK.
    4. Add cellular subinterfaces for each additional DNN session.
      1. On the Subinterfaces tab, click Add.
      2. Enter a unit number: 1–7 for SIM slot 1 sessions, or 8–14 for SIM slot 2 sessions.
      3. Choose the SIM Slot that corresponds to the unit number range.
      4. For APN/DNN Profile, choose the DNN profile to assign to this subinterface.
      5. Click OK and repeat for each additional subinterface.
    5. For each subinterface, configure the Security Zone and Virtual Router settings on the IPv4 tab.
    6. Configure policy-based forwarding (PBF) rules to steer traffic to the appropriate DNN subinterface.
    7. Commit.
      A reboot is not required after committing DNN subinterface configurations.
    8. Verify the DNN sessions are active.
      show cellular dnn
      show cellular session detail

    © 2026 Palo Alto Networks, Inc. All rights reserved.