topic Re: Layer 3 Ethernet Interface vs Layer 3 VLAN interface in General Topics

Layer 3 Ethernet Interface vs Layer 3 VLAN interface

S_Williams901 — Mon, 08 Apr 2024 20:30:41 GMT

Trying to really understand the difference here. I have never made a Layer 3 VLAN interface using the VLAN tab on "interfaces".

When I make a layer 3 interface I use Ethernet Layer 3 interface that connects downstream to a switch. From what I can tell Layer 3 VLAN interface is a scenario for when you have physical clients connected to the firewall ports, like a switch. But seems like a hard sell since the availability of ports on most models.

Re: Layer 3 Ethernet Interface vs Layer 3 VLAN interface

BPry — Mon, 08 Apr 2024 21:16:50 GMT

@S_Williams901,

You'd create a layer3 subinterface with the proper tag that matched your trunk VLAN. Unless someone can articulate their actual requirements to utilize layer2 interfaces on their firewall I don't personally see any reason why you'd utilize them. You can configure a trunk up to your firewall and just create layer3 subinterfaces with the proper tag.

Re: Layer 3 Ethernet Interface vs Layer 3 VLAN interface

S_Williams901 — Tue, 09 Apr 2024 14:04:15 GMT

That is what I do now. But watching a demo on connecting actual clients to the firewall and assigning the ports to vlans, then using the vlan tab in interfaces, they created a IP created vlan "interface"

Re: Layer 3 Ethernet Interface vs Layer 3 VLAN interface

Brandon_Wertz — Tue, 09 Apr 2024 19:23:24 GMT

@S_Williams901 wrote:

That is what I do now. But watching a demo on connecting actual clients to the firewall and assigning the ports to vlans, then using the vlan tab in interfaces, they created a IP created vlan "interface"

Like @BPry has previously mentioned the L3 VLAN can just be a sub-interface of an aggregate-ethernet (AE - Palo Port-Channel.) While you might have seen other videos online that tie a L3 VLAN to a physical port that is ONE way to do it, but not required. You can have 40 L3 VLANs as a "sub-interface" on a single AE or singular port if desired.