Add logical interfaces

Logical interfaces are used in the configuration of the following types of interfaces to represent one or more network interfaces:

• Capture interfaces on Firewalls, IPS Engines, and Layer 2 Firewalls
• Inline interfaces on IPS engines and Layer 2 Firewalls
• Inline IPS interfaces on Firewalls
• Inline Layer 2 Firewall interfaces on Firewalls

You cannot use the same logical interface to represent both capture interfaces and inline interfaces on the same engine. On Firewalls, you cannot use the same logical interface to represent both inline IPS interfaces and inline Layer 2 Firewall interfaces. Otherwise, a logical interface can represent any number or combination of physical interfaces or VLAN Interfaces.

There is one predefined logical interface element called default_eth. If you want to create both capture interfaces and inline interfaces on the same NGFW Engine, you must add at least one more logical interface.

On IPS engines and Layer 2 Firewalls, a logical interface element called System Communications is automatically assigned to interfaces that have an IP address that is used as the primary or backup Control IP address. You can use the System Communications logical interface to represent all Control IP addresses in IPS and Layer 2 Firewall Policies.

You can use logical interfaces in IPS Policies, Layer 2 Firewall Policies, and Layer 2 Interface Policies to limit the scope of your rules. You can use logical interfaces to create rules that match based on which interface the traffic was picked up from. For example, you can create a different logical interface for each VLAN and use them to create rules that apply only to traffic from a specific VLAN.

  For more details about the product and how to configure features, click Help or press F1.