Layer 2 Switch Interfaces
Configure Layer 2 switch interfaces to replace a standalone access switch with
built-in switching on supported firewalls.
| Where Can I Use This? | What Do I Need? |
|---|
- NGFW (Managed by PAN-OS or Panorama)
|
- PAN-OS 12.2.2 or a later release
- PA-500 Series: PA-550, PA-560
- No additional license required
|
Layer 2 switch interfaces let you consolidate a dedicated access switch and a
firewall into a single physical device, a branch in a box solution.
When you configure an interface as Layer2 Switch, PAN-OS®
offloads east-west switching to the hardware switch ASIC on supported PA-500 firewalls, freeing the CPU
for security processing. Intra-VLAN traffic is forwarded in hardware at Layer 2
without traversing the firewall's security stack; however, if a zone-based firewall
policy is applied to the interface, forwarding falls back to CPU-based processing
rather than hardware switching. Traffic that crosses a VLAN boundary or reaches a
Layer 3 interface is always inspected by zone-based security policy.
Layer 2 switch interfaces coexist with the existing
Layer 2 interface type.
You can further segment switch traffic using micro-segmentation. The following use
cases apply:
Layer 2 switch interfaces support:
- Access and trunk port modes with 802.1Q VLAN tagging
- Link aggregation (IEEE 802.1AX) with static or LACP-dynamic port channels
- Spanning Tree Protocol (IEEE 802.1w RSTP and 802.1s MSTP) for loop
prevention
- Storm control to limit broadcast, unknown unicast, and multicast (BUM)
flooding
- LLDP on both regular and aggregated interfaces
- VLAN interfaces as the Layer 3 endpoint
for routed traffic
Maximum Active VLANs Support on Firewalls
The following table lists the maximum number of active VLANs supported by each
firewall.
| Firewall | Maximum Active VLANs |
|---|
Each firewall supports up to 12 aggregate Ethernet (AE) interfaces with up to 8
member ports per AE interface.
High Availability Behavior
Layer 2 switch interfaces support active-passive high availability (HA). On the
passive device, Layer 2 switch ports follow the configured HA port mode:
- Shutdown: Layer 2 switch ports are link-down on the
passive device.
- Auto: Layer 2 switch ports are link-up but blocked for
traffic on the passive device.
On failover, the newly active device begins forwarding traffic through its Layer 2
switch ports. STP runtime state is not synchronized between HA peers. STP
reconverges after failover.
