An NGFW engineer is establishing bidirectional connectivity between the accounting virtual system (VSYS) and the marketing VSYS. The traffic needs to…

To enable inter-VSYS communication without external physical connections, the firewall utilizes external zones and inter-VR routing. However, a fundamental prerequisite for traffic to successfully cross the logical boundary between two distinct virtual systems is configuring mutual VSYS visibility. By adding each VSYS to the "Visible Virtual Systems" list of the other within the device settings, the PAN-OS firewall is explicitly authorized to route traffic and pass session information between those specific virtual environments. Without establishing this mutual visibility, the firewall's routing engine will inherently drop the inter-VSYS traffic, regardless of whether the external zones, inter-VR static routes, and intra-VSYS security policies have been perfectly configured by the administrator.

A. A transit VSYS is used for shared internet access or complex hub-and-spoke topologies; it is not required for direct bidirectional communication between two virtual systems.
C. There is no "allow inter-VSYS traffic" checkbox or configuration option within the external zone settings in the PAN-OS architecture.
D. Security policies are enforced strictly within the context of a single VSYS. You cannot create a single policy that spans between two external zones residing in different virtual systems.

1. Palo Alto Networks. (2023). PAN-OS® 11.0 Administrator’s Guide. Section: Virtual Systems > Inter-VSYS Routing.

2. Palo Alto Networks. (2023). PAN-OS® 11.0 Administrator’s Guide. Section: Virtual Systems > Configure Inter-VSYS Routing (Step 2 explicitly mandates: "Configure virtual system visibility. To allow communication between virtual systems, you must configure the virtual systems to be visible to each other").