>
    Strata Copilot
    Configure a Layer 2 Switch Access Port
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. Configure Interfaces
    4. Layer 2 Switch Interfaces
    5. Configure a Layer 2 Switch Access Port
    Download PDF
    Next-Generation Firewall

    Configure a Layer 2 Switch Access Port

    Table of Contents

    Configure a Layer 2 Switch Access Port

    Configure an access port to connect end devices such as workstations, IP phones, and printers to a single VLAN on a Layer 2 switch interface.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by PAN-OS or Panorama)
    • PAN-OS 12.2.2 or a later release
    • PA-500 Series: PA-550, PA-560
    • (Recommendation) Create the STP global profile and any port profiles before configuring interfaces.
    • No additional license required
    An access port carries traffic for a single untagged VLAN. Frames entering an access port are treated as belonging to the configured VLAN and exit the switch without 802.1Q tags. PAN-OS offloads switching for this traffic to the hardware switch ASIC, freeing the CPU for security processing.
    1. Select NetworkInterfacesEthernet.
    2. Click the interface you want to configure, such as ethernet1/7.
    3. For Interface Type, select Layer2 Switch.
    4. For Port Type, select Access.
    5. On the Config tab, configure the access VLAN:
      1. For Access VLAN Tag, enter the VLAN ID (1-4000, excluding 4001-4095).
      2. For VLAN, choose the VLAN object for this VLAN.
      3. (Optional) For Security Zone, choose a zone to apply zone-based security policy to east-west traffic on this port. Leave as None for hardware switching without ZBFW inspection.
        Once a zone is assigned to a VLAN on an interface, that VLAN becomes zone-based. All Layer 2 switch interfaces that are members of that VLAN must also have a zone assigned, though each interface can be assigned a different zone.
        The VLAN tag configured on an interface must be consistent across all Layer 2 switch interfaces that are members of that VLAN.
    6. (Optional) To limit BUM flooding on this port, click the Storm Control tab. See Configure Storm Control for parameter details.
    7. (Optional) To apply port-level STP parameters, in the STP tab, select the STP port profile you created. If no port profile is selected, default STP parameters are applied to the port. Optionally, specify the STP Port Priority and Path Cost to override the default values applied to the port. See Configure Spanning Tree Protocol.
    8. Select OK and then Commit.

    © 2026 Palo Alto Networks, Inc. All rights reserved.