An administrator notices that traffic between two internal subnets connected to the same Palo Alto Networks firewall is not being inspected by security policies. The interfaces for both subnets are configured as Layer 3. What is the most likely reason for this behavior?
Trap 1: Layer 3 interfaces cannot route traffic between internal subnets…
Layer 3 interfaces on the firewall can route traffic between subnets directly if they belong to the same virtual router.
Trap 2: The interfaces must be converted to Virtual Wire mode for internal…
Layer 3 interfaces route between subnets, but same-zone traffic bypasses security policy by default; placing both subnets in different zones (or enabling intrazone inspection) is what forces inspection. Virtual Wire is for inline taps without IP addressing, not routed internal subnets.
Trap 3: NAT must be configured for all internal-to-internal routing.
NAT is not required for routing traffic between internal subnets.
- A
Layer 3 interfaces cannot route traffic between internal subnets without an external router.
Why it fails: Layer 3 interfaces on the firewall can route traffic between subnets directly if they belong to the same virtual router.
- B
There is no explicit Security Policy rule allowing traffic between the two zones.
Inter-zone traffic requires an explicit security policy rule; by default, traffic between different zones is denied.
- C
The interfaces must be converted to Virtual Wire mode for internal inspection.
Why it fails: Layer 3 interfaces route between subnets, but same-zone traffic bypasses security policy by default; placing both subnets in different zones (or enabling intrazone inspection) is what forces inspection. Virtual Wire is for inline taps without IP addressing, not routed internal subnets.
- D
NAT must be configured for all internal-to-internal routing.
Why it fails: NAT is not required for routing traffic between internal subnets.