>
    Strata Copilot
    Configure a Layer 3 LAN Interface
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma SD-WAN
    3. Prisma SD-WAN Administrator’s Guide
    4. Prisma SD-WAN Sites and Devices
    5. Prisma SD-WAN Ports and Interfaces
    6. Configure a Layer 3 LAN Interface
    Download PDF
    Prisma SD-WAN

    Configure a Layer 3 LAN Interface

    Table of Contents

    Configure a Layer 3 LAN Interface

    Learn to configure a L3 LAN interface in Prisma SD-WAN. The LAN interface's enhanced L3 capabilities allow for simplified topologies and help facilitate an improved branch HA model.
    Where Can I Use This?What Do I Need?
    • Prisma SD-WAN (Managed by Strata Cloud Manager)
    • Prisma SD-WAN
    Prisma SD-WAN extends the capabilities of the Layer 3 LAN interface to include traffic forwarding. Release 5.1.1 and later enables you to use Layer 3 LAN interfaces for services such as DHCP Relay, DHCP Server, SNMP source interface, and so on. The LAN interface's enhanced Layer 3 capabilities allow for simplified topologies and help facilitate an improved branch HA model. Layer 3 LAN interface can be configured with a static or dynamic IP address and is used to forward traffic to and from the LAN. Layer 3 LAN Interface now supports static routing.
    When Virtual Routing and Forwarding tables (VRF) is configured on a sub-interface:
    • Select LAN type interface for branch sites.
    • Select Peer with the Network for data center sites.
    1. Select ConfigurationPrisma SD-WANION DevicesClaimed, select the device you want to configure.
    2. On the Basic Info screen, toggle Yes for Enable L3 Direct Private WAN Forwarding.
    3. Click Save.
    4. Select the Interfaces tab and select a port that connects to the LAN.
    5. Select a port that connects to the LAN.
    6. In the General section,
      1. Enter a Name and (Optional) Description, and add Tags for the port channel interface.
      2. For Admin Up, select Up.
    7. In the Network Setting section,
      1. Select Port as the Interface type.
      2. For Use This Port For, select LAN.
      3. Toggle Scope as Global or Local.
      4. For VRF, select Globalor any other custom VRF that is available and associated in the VRF profile. VRF Global is enabled only when the associated device supports VRF.
      5. For Security Zone, select a device to bind.
      6. Select Enable IPv6 On This Interface to configure IPv6.
        For IPv6 Configuration, select AutoConf or Static.
        Autoconf indicates the Global IP address is derived using stateless address autoconfiguration (SLAAC).
        Choose Static if the IP address is fixed and is manually assigned. Additionally specify the IPv6 Address/Mask, Default Gateway (IPv6), and DNS server(s) (IPv6).
        In Advanced Options, you can specify, IPv6 Prefix Distribution, for address distribution.
        IPv6 is supported only for Global VRF.
      7. Select IPv4 Configuration as either DHCP or Static.
        If Static is selected, enter an IP address and mask for the interface.
        Default Gateway and DNS server configurations are not required for LAN interfaces. This is indicated by using LAN in the Use This Port For field.
        Select DHCP for dynamic allocation of IP address.
        If DHCP Relay functions are required, then click the DHCP Relay drop-down and select Yes for Enabled.
        For Server IPs, add server IP addresses as required.
    8. Save.

    © 2026 Palo Alto Networks, Inc. All rights reserved.