Deployment Scenarios and Migration Best Practices

A Palo Alto Networks firewall can be placed into a network in three fundamental deployment modes: virtual wire, Layer 2, and Layer 3. Each mode changes how the firewall sees and processes traffic. For a complete beginner, think of the firewall as a security guard standing in a hallway. In virtual wire mode, the guard does not ask for any identification; he simply inspects everyone who walks through and lets them pass or stops them, without changing their name tag. The firewall becomes invisible to the network – it has no IP address of its own on the segment and does not participate in routing. This mode is perfect when you want to insert security into an existing network without redesigning IP addresses or changing the switch and router configurations. The firewall simply forwards frames (data packets) between two interfaces as if they were a single wire.

In Layer 2 mode, the firewall behaves like a transparent bridge. It has an IP address for management – a way for the administrator to talk to it – but it does not route traffic. Instead, it learns MAC addresses (the hardware addresses of devices) and forwards frames based on those addresses, just like a switch. The benefit is that the firewall can still inspect traffic and enforce security policies without requiring any changes to the IP addressing scheme of the network. It sits in the middle of a broadcast domain, like a security checkpoint inside a single office floor where everyone already knows each other’s desk numbers.

In Layer 3 mode, the firewall acts as a router. It has its own IP addresses on each interface, it runs routing protocols (like OSPF or BGP) to exchange routes with neighbouring routers, and it makes forwarding decisions based on destination IP addresses. This mode requires you to assign new IP subnets to the firewall’s interfaces and often means renumbering adjacent devices. Layer 3 mode is the most flexible because the firewall can perform all advanced features – NAT (network address translation), VPN termination, traffic shaping, and deep packet inspection on routed traffic. It is the default mode for most internet-facing deployments.

Why do these modes exist? Because networks are messy and businesses cannot always re-IP everything just to add a firewall. Virtual wire and Layer 2 let you insert security without architectural change. Layer 3 lets you take full control when you can plan the addressing.

Migration from a legacy firewall (like a Cisco ASA or a Check Point appliance) is a separate but equally critical skill. The goal is to replace the old firewall with a Palo Alto firewall with minimal downtime and zero security gaps. The best practice is the “pre-stage and cutover” method:

This method avoids the classic trap of trying to “hot swap” rules on the fly. The PCNSE exam expects you to know that virtual wire mode is the simplest for migration because it requires no IP changes at all. Layer 3 migrations often fail because administrators forget to update the default gateway on end devices or redistribute routes.

Another key concept is the use of “logical” versus “physical” interfaces. In virtual wire mode, you pair two physical interfaces (or sub-interfaces) into a virtual wire. Traffic enters one and exits the other with no MAC or IP header changes. In Layer 2, you create a VLAN interface (an L3 interface) for management but traffic stays bridged. In Layer 3, each physical interface or sub-interface gets its own IP address.

The exam also tests your understanding of “tap mode” – a fourth, less common deployment where the firewall only listens to traffic (like a network sniffer) and does not block anything. This is used for monitoring only, not for enforcement.

Finally, migration best practices include creating a migration plan document, testing in a lab first, using the “Security Policy Optimizer” tool to clean up unused rules, and always having a rollback strategy. The most common exam trap is assuming you can migrate a virtual wire firewall to Layer 3 without changing the IP scheme – you cannot, because Layer 3 requires IP addresses on the firewall interfaces, which changes the network’s addressing.

An IT professional at a mid-sized company is tasked with replacing an ageing Cisco ASA firewall that connects the corporate office to the internet. The company has 500 users, three internal subnets, and a static public IP from the ISP. The ASA is in Layer 3 mode with NAT (it translates private internal IPs to the public IP).

The IT professional starts by creating a detailed migration plan. She physically racks the new PA-Series firewall in the same server rack, just above the Cisco ASA. She connects the same copper cables from the ISP modem and the internal switch to the Palo Alto interfaces, but leaves the Palo Alto ports administratively down. She then uses Expedition (Palo Alto’s free migration tool) to import the Cisco ASA configuration. Expedition converts the ASA ACLs (access control lists) and NAT rules into Panorama or local firewall policy format. She reviews the converted rules, merging duplicates and removing expired ones.

Next, she sets up the Palo Alto firewall in Layer 3 mode. She assigns the same IP address to the Palo Alto’s external interface that the ASA used, and configures the internal interface with the same default gateway IP for the internal subnet. She builds a simple security policy: allow internal users to browse the web (HTTP/HTTPS), deny inbound traffic except for VPN, and permit only necessary outbound services like DNS and email.

On cutover day, she sends a company-wide email that there will be a 15-minute internet outage at 10:00 PM. She logs into the ASA via SSH, performs a “write mem” to save the running config, then shuts down the ASA. She immediately logs into the Palo Alto and commits the configuration. She enables the external and internal interfaces. She pings the ISP’s next-hop IP from the Palo Alto – successful. She asks a colleague in the office to load a website – successful. She then monitors the traffic logs for 30 minutes, looking for denied traffic that should be permitted. She finds that the internal DNS server’s queries are being dropped because the DNS server’s source IP was not in the allowed list. She quickly adds a temporary allow rule, then refines it the next morning.

Finally, she leaves the ASA powered off but cabled in place for 72 hours as a rollback option. If something catastrophic happens, she can power the ASA back on and re-cable in 5 minutes. After a week of stable operation, she decommissions the ASA and updates the network diagram.

The key actions an IT professional performs in this scenario are: