What's the difference between Layer 3 mode and Virtual Wire mode on a Palo Alto interface, and when would you choose Layer 3?
Layer 3 mode lets the firewall act as a router — it has IP addresses on each interface, makes IP-based routing/policy decisions, and supports NAT. Virtual Wire (V-Wire) is a transparent Layer 2 pass-through — the firewall is invisible to routing, with no IP addresses, useful for inserting a firewall into an existing network without re-IPing.
* The four PAN-OS interface modes — only Layer 3 routes and does NAT/DHCP. *
The two modes side-by-side:
| Aspect | Layer 3 | Virtual Wire |
|---|---|---|
| Has IP addresses |  Yes (one per interface) |
 No |
| Does routing | Yes |
No (just bridges) |
| Supports NAT | Yes |
No |
| Visible to traceroute | Yes (one hop) |
No (transparent) |
| Re-IPing required to deploy | Yes |
No |
| Use case | New deployments, perimeter routers | Inserting FW into existing L2 segment |
Why this setup needs Layer 3:
"Die Umstellung auf Layer 3 ist notwendig, da in diesem Setup IP-Adressen und Routing verwendet werden sollen, um den Datenverkehr zwischen den Zonen gezielt zu steuern."
This design requires:
- Different subnets per zone (10.0.0.0/24, 192.168.100.0/24, etc.)
- Routing between subnets (firewall is the gateway)
- NAT for SNAT (outbound) and DNAT (inbound)
- DHCP server on the firewall
None of this works in Virtual Wire mode — V-Wire just passes Ethernet frames without inspection of L3 fields beyond what's needed for security policy.
When V-Wire is preferred:
- Existing complex network that you don't want to renumber
- IDS/IPS deployment where the firewall is purely a sensor
- Compliance "tap" mode — invisible inline inspection
- Multi-tenant providers where the FW shouldn't appear in any tenant's routing table
Tip: Most teaching environments use Layer 3 because it's the more common deployment and exposes more concepts (routing, NAT, DHCP). V-Wire is a specialty mode you'll meet in retrofit scenarios — important to know it exists, but rare in greenfield designs.
Go deeper:
Palo Alto firewall security zones: Tap, Virtual Wire, Layer 2 and Layer 3 (Firewall.cx) — walks through all four interface/zone deployment modes side by side, so you can see exactly where V-Wire (transparent) and Layer 3 (routed, IP-addressed) differ.