Zone Protection for a Virtual Wire Interface
You can provide virtual wire interfaces with zone protection;
a few packet-based attack protections that are based on IP addresses
don’t apply to virtual wire interfaces. In PAN-OS 8.0 and later
releases, you can protect virtual wire interfaces from non-IP protocols
of your choosing.
You can apply zone protection to a virtual wire interface,
but because virtual wire interfaces don’t perform routing, you can’t
apply
Packet Based Attack Protection to
packets coming with a spoofed IP address, nor can you suppress ICMP
TTL Expired error packets or ICMP Frag Needed packets.
By default, a virtual wire interface forwards all non-IP traffic
it receives. However, you can apply a zone protection profile with
Protocol Protection to
block or allow certain non-IP protocol packets between security
zones on a virtual wire.
