Lab · Create an Interface
← All Labs Simulator →

Step-by-step: Bring up a new interface in a new zone

Goal: Configure ethernet1/4 as a Layer-3 interface with IP 10.30.0.1/24, place it in a brand-new security zone called guest, then commit and verify with the CLI.
Difficulty: Beginner Time: ~10 min Uses: Network tab · CLI tab Skill: PCNSA fundamentals
0 / 10 steps

1Open the Network tab

In the top tab strip of the PAN-OS simulator, click Network. This is where all interface, zone, virtual-router, DNS proxy, and VPN settings live.

Why: Interfaces and the zones they sit in are network-layer constructs. The Network tab is your home base for any Layer-1, Layer-2, or Layer-3 plumbing.
You'll see: The left sidebar changes to show Network sub-items — Interfaces, Zones, Virtual Routers, DNS Proxy, GlobalProtect, IPsec Tunnels.
Click here ↓
Dashboard
ACC
Monitor
Policies
Objects
Network
Device
CLI

2First, create the zone — click "Zones" in the sidebar

Before assigning an interface to a zone, the zone needs to exist. The default config has trust and untrust only — we want a third one called guest.

  1. In the left sidebar, click Zones.
Why: If you try to set an interface's zone to a name that doesn't exist yet, the form will accept it, but it'll create an empty broken zone. Cleaner to make the zone first, then attach the interface.
Sidebar fragment
Network
Interfaces 3
Zones 2
Virtual Routers
DNS Proxy
GlobalProtect
IPsec Tunnels
main panel switches to Zones screen…

3Click "+ Add Zone"

Above the zone table you'll see a toolbar with a single blue button.

  1. Click the + Add Zone button (top-left of the table).
You'll see: A modal dialog titled "Add Zone" opens.
Click the highlighted button
NameTypeInterfaces
trustlayer3ethernet1/1
untrustlayer3ethernet1/2

4Fill the Add Zone form

Enter the following exactly:

  • Name: guest
  • Type: layer3 (this is the default — leave it)
  • Interfaces: leave empty for now — we'll attach ethernet1/4 automatically when we configure the interface in Step 6.

Then click OK.

Don't see the new zone yet in the table? You will, the moment you click OK. It also won't be saved permanently until you Commit at Step 9.
Modal dialog
Add Zone✕
guest
layer3
(empty — attach later)

5Switch to Interfaces

The zone is created (zone counter went from 2 → 3). Now switch the sidebar to Interfaces.

  1. Click Interfaces in the left sidebar.
You'll see: A table of 3 interfaces (eth1/1, 1/2, 1/3). Notice ethernet1/3 currently shows state down with no zone or IP — that's the one we'll bring up.
Sidebar — now zones=3
Network
Interfaces 3
Zones 3 ↑
Virtual Routers
DNS Proxy
GlobalProtect
IPsec Tunnels
InterfaceZoneIPState
ethernet1/1trust10.10.10.1/24up
ethernet1/2untrust203.0.113.1/30up
ethernet1/3——down

6Click "+ Add Interface"

We won't edit eth1/3 — instead we add a brand-new interface (eth1/4) so the lab is repeatable.

  1. Click the + Add Interface button.
Toolbar above the interface table
3 interfaces

7Fill the Add Interface form

Enter each field exactly as shown:

  • Interface: ethernet1/4 (pre-filled with the next available number — verify and adjust if needed)
  • Type: layer3
  • Zone: guest (this is the zone we created in step 4)
  • IP Address: 10.30.0.1/24 (CIDR notation — slash + bits)
  • State: up

Click OK.

Notice: typing guest in the Zone field works because the zone exists. If you'd typed finance instead, the simulator would create a new (empty) zone on the fly — but that's an easy way to end up with typo'd zones that don't match your security policies. Always create zones first.
Modal — fill all 5 fields
Add Interface✕
ethernet1/4
layer3
guest
10.30.0.1/24
up

8Verify the new row + spot the Commit alert

Two things to look for:

  1. A new row in the Interface table for ethernet1/4 with zone guest, IP 10.30.0.1/24, state up.
  2. The Commit button in the top-right of the header just went from green to amber and pulsing. That's how PAN-OS tells you there are candidate changes waiting to be applied.
Why the colour change matters: Until you commit, the change exists only in the candidate config. It's saved to your workspace (survives refresh) but it's not yet enforced by the data plane. The amber pulse is your reminder.
After clicking OK
InterfaceZoneIPState
ethernet1/1trust10.10.10.1/24up
ethernet1/2untrust203.0.113.1/30up
ethernet1/3——down
ethernet1/4guest10.30.0.1/24up
Top header — Commit changes colour
BEFORE
Commit
→
AFTER (pulsing)
Commit

9Click Commit and watch the progress

Click the amber Commit button in the top-right of the header.

You'll see: A modal opens, listing your pending changes ("add zone guest", "add interface ethernet1/4"). A progress bar animates through 7 stages — Validating → Generating → Building → Activating → Configuration committed successfully.
Why a real PAN-OS commit takes 30-90 seconds in production: the firewall has to compile every rule into a fast-path forwarding tree, validate cross-references (does this rule's "guest" zone actually exist?), and atomically swap the running config. The simulator runs the same workflow in ~2 seconds.
Commit modal
Commit✕
Changes to commit (2):
  • add zone "guest"
  • add interface "ethernet1/4"
85%
Activating new configuration...

10Verify with the CLI

This is the L3 engineer habit you should build: after every GUI change, verify in the CLI. Three commands prove the work:

  1. Click the CLI tab.
  2. Run show interface ethernet1/4 — confirm zone, IP, runtime status.
  3. Run show running-config — find the <entry name="ethernet1/4"> block.
  4. Run test security-policy-match from guest to untrust source 10.30.0.10 destination 8.8.8.8 protocol 6 — currently this returns "No matching rule. Implicit deny." because we haven't written a security policy for the guest zone yet. That's expected!
Bonus task: write a security rule from guest → untrust action allow, application any. Then re-run the test security-policy-match command and watch the answer change to point at your new rule.
CLI output
PA-VM> show interface ethernet1/4 Name: ethernet1/4 Operation mode: layer3 Zone: guest Virtual router: default IP address: 10.30.0.1/24 Runtime status: up Counters: bytes received: 0 bytes transmitted: 0 packets received: 0 packets transmitted: 0 drops: 0 errors: 0 PA-VM> test security-policy-match from guest to untrust source 10.30.0.10 destination 8.8.8.8 protocol 6 No matching rule. Implicit deny.
All 10 steps complete? The new interface is live, in its own security zone, ready for policy work. Next lab walks you through writing the guest→untrust security policy so the new subnet actually has internet access.
More Labs Open Simulator →