Layer 3 Ethernet Interface vs Layer 3 VLAN interface

[S_Williams901]

Trying to really understand the difference here. I have never made a Layer 3 VLAN interface using the VLAN tab on "interfaces".

When I make a layer 3 interface I use Ethernet Layer 3 interface that connects downstream to a switch. From what I can tell Layer 3 VLAN interface is a scenario for when you have physical clients connected to the firewall ports, like a switch. But seems like a hard sell since the availability of ports on most models. 

[BPry]

@S_Williams901,

You'd create a layer3 subinterface with the proper tag that matched your trunk VLAN. Unless someone can articulate their actual requirements to utilize layer2 interfaces on their firewall I don't personally see any reason why you'd utilize them. You can configure a trunk up to your firewall and just create layer3 subinterfaces with the proper tag.

[S_Williams901]

That is what I do now. But watching a demo on connecting actual clients to the firewall and assigning the ports to vlans, then using the vlan tab in interfaces, they created a IP created vlan "interface"

[Brandon_Wertz]

---

@S_Williams901 wrote:

That is what I do now. But watching a demo on connecting actual clients to the firewall and assigning the ports to vlans, then using the vlan tab in interfaces, they created a IP created vlan "interface"

---

Like @BPry has previously mentioned the L3 VLAN can just be a sub-interface of an aggregate-ethernet (AE - Palo Port-Channel.)  While you might have seen other videos online that tie a L3 VLAN to a physical port that is ONE way to do it, but not required.  You can have 40 L3 VLANs as a "sub-interface" on a single AE or singular port if desired.