Which interface type can use virtual routers and routing protocols?

A Layer 3 interface is a routed port on a Palo Alto Networks firewall. To function, it must be configured with an IP address and assigned to a virtual router. The virtual router maintains a routing table and makes forwarding decisions for traffic arriving on the Layer 3 interface. This configuration enables the firewall to participate in the network's routing fabric, either through static routes or by running dynamic routing protocols such as OSPF, BGP, and RIP. This is the only interface type designed specifically for IP routing functions.

A. Tap: A Tap interface is used for passive monitoring of network traffic from a SPAN or mirror port; it does not forward traffic or participate in routing.
C. Virtual Wire: A Virtual Wire interface transparently passes traffic between two ports at Layer 1/2, acting as a "bump in the wire" without any MAC or IP addresses, and thus performs no routing.
D. Layer 2: A Layer 2 interface functions like a switch port, forwarding traffic based on MAC addresses within a VLAN. It does not have an IP address and does not perform routing.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide, Version 11.0. "Layer 3 Interfaces". In the section "Network > Interfaces > Layer3 Interfaces," the guide states, "A Layer 3 interface on the firewall routes traffic between multiple ports by using the TCP/IP address to make routing decisions... You must add a Layer 3 interface to a virtual router on the firewall."

2. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide, Version 11.0. "Virtual Routers". This section details how virtual routers are used for routing and explicitly links them to Layer 3 interfaces.

3. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide, Version 11.0. "Interface Types". This section provides an overview, clearly distinguishing the roles: "Tap—Passively monitor traffic flow... Virtual Wire—Transparently bind two ports... Layer 2—Switch traffic between two or more network segments... Layer 3—Route traffic between ports."