A customer has just launched a Palo Alto Networks VM-Series NGFW into an Amazon Web Services VPC to protect a cloud hosted application. They are experiencing unpredictable results and have identified that the interfaces on the firewall are in the incorrect order Which PAN-OS CLI command resolves this issue?

In some public cloud environments, including Amazon Web Services (AWS), the order in which network interfaces are attached to a virtual machine can be unpredictable. This can cause the VM-Series firewall's management interface (eth0) and the first data interface (eth1/ethernet1/1) to be swapped. The PAN-OS command set system setting mgmt-interface-swap enable yes is specifically designed to resolve this issue by instructing the firewall to swap these two interfaces internally, ensuring correct traffic flow and management access.

B. set mgmt-interface settings swap yes: This is not a valid PAN-OS command. System-level settings are configured under the set system hierarchy, not directly under a non-existent set mgmt-interface path.
C. set mgmt-interface swap yes: This is also an invalid PAN-OS command syntax. The command structure is incorrect for modifying this specific system setting.
D. set system setting mgmt-interface swap yes: This command is syntactically incorrect. The correct parameter to enable this boolean feature is enable yes, not just swap yes.

1. Palo Alto Networks Documentation, VM-Series Deployment Guide for AWS: In the section "Initial Configuration on the VM-Series Firewall on AWS," the guide explicitly states: "If the management interface and the first dataplane interface are swapped, you can use the following CLI command to correct the interface order: > set system setting mgmt-interface-swap enable yes". (Reference: VM-Series Deployment Guide, AWS, Initial Configuration on the VM-Series Firewall on AWS).

2. Palo Alto Networks Documentation, PAN-OS® CLI Quick Start: The command hierarchy for system settings is detailed here. It confirms that modifications to system behavior, such as interface swapping, are located under the set system setting path. The specific command mgmt-interface-swap is listed with its enable parameter. (Reference: PAN-OS® CLI Quick Start, Use Set Commands to Modify the Configuration).