A Palo Alto Networks Next-Generation Firewall (NGFW) can operate in multiple deployments at once because the deployments occur at the interface level. For example, you can configure some interfaces as Layer 3 interfaces to integrate the firewall into your dynamic routing environment, while configuring other interfaces to integrate into your Layer 2 switching network.

Determine what type of interfaces you need to configure on your firewall. From a high-level viewpoint, a tap interface enables you to access data flowing across a computer network. A virtual wire interface logically connects two interfaces and is internal to the firewall. A Layer 2 interface enables switching between two networks. A Layer 3 interface enables routing between multiple ports. A cellular interface provides data connectivity using the 5G, 4G, or 3G network. An aggregate interface group combines multiple Ethernet interfaces into a virtual interface, increasing bandwidth and providing redundancy. You can configure an IPv6 PPPoE client for an Ethernet Layer 3 interface or subinterface. You can configure the Bonjour Reflector for network segmentation. Learn how to use Interface Management profiles to restrict access.