>
    Strata Copilot
    Configure Interfaces and Zones
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. Perform the Initial Setup and Configuration for NGFWs
    4. Segment Your Network for a Reduced Attack Surface
    5. Configure Interfaces and Zones
    Download PDF
    Next-Generation Firewall

    Configure Interfaces and Zones

    Table of Contents

    Configure Interfaces and Zones

    Configure interfaces and zones on your NGFW to segment your network.
    Where Can I Use This?What Do I Need?
    • NGFW
    One of these licenses for Strata Cloud Manager managed NGFWs:
    • Strata Cloud Manager Essentials
    • Strata Cloud Manager Pro
    After you identify how you want to segment your network and the zones you will need to create to achieve the segmentation (as well as the interfaces to map to each zone), you can begin configuring the interfaces and zones on the NGFW. Configure interfaces on the NGFW to support the topology of each part of the network you are connecting to. The following workflow shows how to configure Layer 3 interfaces and assign them to zones. For details on integrating the NGFW using a different type of interface deployments (for example as virtual wire interfaces or as Layer 2 interfaces), see the Networking Administration guide.
    For more information about Zones, click here.
    The NGFW comes preconfigured with a default virtual wire interface between ports Ethernet 1/1 and Ethernet 1/2 (and a corresponding default security policy and virtual router). If you do not plan to use the default virtual wire, you must manually delete the configuration and commit the change before proceeding to prevent it from interfering with other settings you define. For instructions on how to delete the default virtual wire and its associated security policy and zones, see Step 3 in Set Up Network Access for External Services.

    Configure Interfaces and Zones (PAN-OS)

    Configure interfaces and zones on your NGFW to segment your network in PAN-OS.
    1. Configure a default route to your Internet router.
      1. Select NetworkVirtual Router and then select the default link to open the Virtual Router dialog.
      2. Select the Static Routes tab and click Add. Enter a Name for the route and enter the route in the Destination field (for example, 0.0.0.0/0).
      3. Select the IP Address radio button in the Next Hop field and then enter the IP address and netmask for your Internet gateway (for example, 203.0.113.1).
      4. Click OK twice to save the virtual router configuration.
    2. Configure the external interface (the interface that connects to the Internet).
      1. Select NetworkInterfaces and then select the interface you want to configure. In this example, we are configuring Ethernet1/8 as the external interface.
      2. Select the Interface Type. Although your choice here depends on interface topology, this example shows the steps for Layer3.
      3. On the Config tab, select New Zone from the Security Zone drop-down. In the Zone dialog, define a Name for new zone, for example Internet, and then click OK.
      4. In the Virtual Router drop-down, select default.
      5. To assign an IP address to the interface, select the IPv4 tab, click Add in the IP section, and enter the IP address and network mask to assign to the interface, for example 203.0.113.23/24.
      6. To enable you to ping the interface, select AdvancedOther Info, expand the Management Profile drop-down, and select New Management Profile. Enter a Name for the profile, select Ping and then click OK.
      7. To save the interface configuration, click OK.
    3. Configure the interface that connects to your internal network.
      In this example, the interface connects to a network segment that uses private IP addresses. Because private IP addresses cannot be routed externally, you have to configure NAT.
      1. Select NetworkInterfaces and select the interface you want to configure. In this example, we are configuring Ethernet1/15 as the internal interface our users connect to.
      2. Select Layer3 as the Interface Type.
      3. On the Config tab, expand the Security Zone drop-down and select New Zone. In the Zone dialog, define a Name for new zone, for example Users, and then click OK.
      4. Select the same Virtual Router you used previously, default in this example.
      5. To assign an IP address to the interface, select the IPv4 tab, click Add in the IP section, and enter the IP address and network mask to assign to the interface, for example 192.168.1.4/24.
      6. To enable you to ping the interface, select the management profile that you just created.
      7. To save the interface configuration, click OK.
    4. Configure the interface that connects to your data center applications.
      Make sure you define granular zones to prevent unauthorized access to sensitive applications or data and eliminate the possibility of malware moving laterally within your data center.
      1. Select the interface you want to configure.
      2. Select Layer3 from the Interface Type drop-down. In this example, we are configuring Ethernet1/1 as the interface that provides access to your data center applications.
      3. On the Config tab, expand the Security Zone drop-down and select New Zone. In the Zone dialog, define a Name for new zone, for example Data Center Applications, and then click OK.
      4. Select the same Virtual Router you used previously, default in this example.
      5. To assign an IP address to the interface, select the IPv4 tab, click Add in the IP section, and enter the IP address and network mask to assign to the interface, for example 10.1.1.1/24.
      6. To enable you to ping the interface, select the management profile that you created.
      7. To save the interface configuration, click OK.
    5. (Optional) Create tags for each zone.
      Tags allow you to visually scan policy rules.
      1. Select ObjectsTags and Add.
      2. Select a zone Name.
      3. Select a tag Color and click OK.
    6. Save the interface configuration.
      Click Commit.
    7. Cable the NGFW.
      Attach straight through cables from the interfaces you configured to the corresponding switch or router on each network segment.
    8. Verify that the interfaces are active.
      Select Dashboard and verify that the interfaces you configured show as green in the Interfaces widget.

    Configure Interfaces and Zones (SCM)

    Configure interfaces and zones on your NGFW to segment your network in Strata Cloud Manager.

    Create an Interface

    Interfaces serve as the fundamental building blocks of your firewall's network connectivity, defining how traffic enters, exits, and flows through your security infrastructure. In Strata Cloud Manager, you can create and configure various types of interfaces to match your specific network architecture and deployment requirements, whether you're implementing network segmentation, connecting to different network zones, or establishing connectivity between network segments. Each interface type serves distinct purposes and operates at different layers of the network stack, from simple traffic monitoring and forwarding to complex routing and switching functions.
    The interface configuration determines how the firewall processes traffic, applies security policies, and integrates with your existing network infrastructure. Choose the appropriate interface type based on your network topology, traffic flow requirements, and the level of packet inspection and processing needed for your deployment:
    • Routing and Interfaces
      • Configure a Layer 2 Interface
      • Configure a Layer 2 Interface

    Create a Zone

    Assign one or more firewall interfaces to a zone to segment your network to control protection for each zone individually.
    1. Log in to Strata Cloud Manager.
    2. Configure your NGFW interfaces.
    3. Select ConfigurationNGFW and Prisma AccessDevice SettingsInterfaces and select the Configuration Scope where you want to create the zone.
      You can select a folder or firewall from your Folders or select Snippets to configure the zone in a snippet.
    4. Add Zone.
    5. Configure the zone.
      1. Select the Interface Type.
        Select Layer2 if you want to add Layer 2 interfaces to the zone or Layer 3 to add Layer 3 interfaces.
      2. Add one or more interfaces to the zone.
      3. (Optional) Select a Zone Protection Profile to specify how the firewall responds to attack from this zone.
        Select Create New to create a new Zone Protection Profile inline.
      4. (Optional) Confirm you want to Enable Packet Buffer Protection.
        This setting is enabled by default. The firewall applies Packet Buffer Protection to the ingress zone only to protect the zone from DoS attacks and aggressive sessions and sources.
      5. (Optional) Enable User ID ACL.
        This setting is disabled by default. When disabled, the firewall applies user mapping information it discovers to all traffic of this zone for use in logs, reports, and policy rules. When enabled, the firewall
      6. (Optional) Enable Device ID ACL.
        This setting is disabled by default.
    6. Save.

    © 2026 Palo Alto Networks, Inc. All rights reserved.