An organization wants to enforce zero trust principles by inspecting all internal east-west traffic between different VLANs terminating on a Palo Alto Networks Next-Generation Firewall. The firewall is currently running in Layer 3 mode. Which configuration step is essential to ensure that inter-VLAN traffic passes through the security inspection engine rather than routing directly through an upstream core switch?
Trap 1: Configure a static multicast route pointing to the loopback address…
Management plane loopback routes have no effect on data plane transit traffic.
Trap 2: Enable Layer 2 mode bridging across all subinterfaces to allow the…
Virtual wire mode bypasses routing capabilities, which defeats Layer 3 multi-VLAN segmentation.
Trap 3: Create a single aggregate interface (AE) and assign all VLAN tags…
Assigning all VLANs to a native VLAN ID prevents proper segmentation and isolation between VLANs.
- A
Configure a static multicast route pointing to the loopback address of the firewall management plane.
Why wrong: Management plane loopback routes have no effect on data plane transit traffic.
- B
Enable Layer 2 mode bridging across all subinterfaces to allow the core switch to perform bridging while the firewall inspects packets in virtual wire mode.
Why wrong: Virtual wire mode bypasses routing capabilities, which defeats Layer 3 multi-VLAN segmentation.
- C
Configure separate subinterfaces for each VLAN, assign each subinterface to a unique security zone, and create a Security policy rule permitting the inter-zone traffic.
Placing VLANs in separate security zones forces the firewall to evaluate Security policy rules for all inter-VLAN traffic.
- D
Create a single aggregate interface (AE) and assign all VLAN tags to the native VLAN ID.
Why wrong: Assigning all VLANs to a native VLAN ID prevents proper segmentation and isolation between VLANs.