Configure Layer 3 Interfaces (SCM)

1. Log in to Strata Cloud Manager.
2. Select ManageConfigurationNGFW and Prisma AccessDevice SettingsInterfacesEthernetConfigurationNGFW and Prisma AccessDevice SettingsInterfacesEthernet and select the Configuration Scope where you want to create the Layer 3 interface.

   Select a firewall from your Folders or select Snippets to configure the Layer 3 interface in a snippet.

   If you select a folder or select a snippet, you create a Layer 3 interface variable that must be assigned at the device level.
3. Add the interface.

   If you’re configuring a Layer 3 interface for a specific firewall, select the interface you want to configure instead.

   • Folders and Snippets—Add Interface and select Interface.
   • Firewalls—Add and Add Interface.
4. Configure the interface.

   If you’re configuring an interface in the folder or snippet scope, the interface configuration is pushed only to firewalls that have the corresponding interface slot available. For example, if you configure Ethernet 1/5 in the folder scope and the firewall associated with the folder has only four interface slots, then the configuration isn’t pushed to the firewall.

   1. Select the interface Slot.
   2. Select the Interface Name.

      When you configure an interface for a specific firewall, the Interface Name is fixed, such as ethernet1/1 if you select Slot 1. The fixed interface names are dependent on the slot that you selected in the previous step.
   3. (Folders and Snippets only) Select the Default Interface Assignment.
   4. (Optional) Enter a Description.
   5. For Interface Type, select Layer3.
   6. (Folders and Snippets only; Optional) Assign the interface to a Logical Router.

      Selecting a global router will prompt a message asking if you want to override and remove the inherited objects. Click Yes to confirm.

      See Configure a Logical Router for more information.
   7. (Folders and Snippets only; Recommended) Assign the interface to a Zone.

      Create New to create a new zone. See Zone Protection and DoS Protection for more information.

      Selecting an inherited zone overrides the previous settings and removes any inherited objects. Any changes made to the global folder are no longer inherited in a top-down manner. A message appears, indicating that the interface settings will be overridden and the inherited objects from the parent folder will be removed on all firewalls. When you save your changes, a confirmation message appears. If you confirm, the zone is overridden.
5. Configure interface IP settings.

   1. Select the interface IP Type.

   • Static IPv4 Address.
     Add the IPv4 IP addresses for the interface.
     If you're configuring a Layer 3 Ethernet interface for the SD-WAN functionality, you can configure up to four IP addresses. Whereas the Auto VPN workflows uses only the first IP address from the configured IPv4 address list to create the VPN tunnel.
   • Activate the DHCP Client on the interface.
     See Configure an Interface as a DHCPv4 Client for more information on configuring the interface as a DHCP client.

   • Activate PPPoE and configure the connection settings.
     Enable to activate the interface for Point-to-Point Protocol over Ethernet (PPPoE) termination. This makes the interface a PPPoE termination point to support connectivity in a Digital Subscriber Line (DSL) environment where there’s a DSL modem but no other PPPoE device to terminate the connection.
6. (Optional) Configure the interface link settings.

   1. Expand the Advanced Settings.
   2. Select the interface Link Speed.

      Auto is selected by default and allows the firewall to determine the speed.
   3. Select the interface Link Duplex transmission mode.

      Auto is selected by default to allow the firewall to negotiate the transmission mode automatically.
   4. Select the interface Link State.

      Auto detect is selected by default to allow the firewall to determine the link state.
7. Assign the interfaces to the aggregate interface group.

   1. Select ManageConfigurationDevice SettingsInterfacesEthernetConfigurationNGFW and Prisma AccessDevice SettingsInterfacesEthernet and select the appropriate Configuration Scope.

      You can select a folder or firewall from the Config Tree or select Snippets to configure the interface in a snippet.
8. Save.
9. Push Config to push your configuration changes.