An NGFW engineer is establishing bidirectional connectivity between the accounting virtual system (VSYS) and the marketing VSYS. The traffic needs to…

In a Palo Alto Networks multi-VSYS environment, traffic cannot pass between virtual systems unless they are explicitly configured to be visible to one another. This is a fundamental security and administrative control. Even with correctly configured external zones, virtual routers, inter-VR static routes, and security policies, the data plane will not forward packets between the VSYS contexts if this visibility is not established. The "Visible Vsys" configuration creates the necessary logical link that allows one VSYS to recognize another as a valid destination for traffic.

A. A transit VSYS is a valid network design for centralizing services, but it is not a mandatory requirement for direct inter-VSYS communication.

C. The zone type "External" is what designates it for inter-VSYS traffic; there is no separate "allow inter-VSYS traffic" checkbox within the zone configuration itself.

D. Security policies are processed within the context of each VSYS. The question states policies are already in place to allow traffic to the external zones within each respective VSYS.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Virtual Systems

" section "Configure Inter-VSYS Routing." The guide outlines the required steps

stating explicitly in Step 5: "For traffic to pass between virtual systems

you must make each virtual system visible to the other. Select a virtual system and in the Visible Vsys field

Add the virtual systems that you want to be able to exchange traffic with the selected virtual system." (p. 1098).

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Virtual Systems

" section "Inter-VSYS Traffic." This section details the traffic flow

which depends on the VSYS visibility setting. It explains

"When the firewall receives a packet

it performs a route lookup to determine the egress interface and zone. If the egress interface belongs to another virtual system

the firewall forwards the packet to that virtual system for policy evaluation..." This forwarding action is contingent on the visibility being configured. (p. 1096).