I'm using a PA-3020 device configured with multiple Vsys and when creating a Vsys I have the ability to assign a specific VR.

From my understanding, the connection between a Vsys to a VR is based on the Vsys connected interfaces to the VR much like in a physical setup where you connect an FW to a router.

So why do I need to assign a VR to a Vsys? Can I use a VR that is only connected to a Vsys without assigning it?


  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Apr 19 '19 at 14:47

As I understand it, a Vsys is a virtual instance you can assign your virtual routers (VR) to. You can't connect them as a Vsys is the scope of a VR.

Check Virtual Systems:


Interfaces and security zones can be grouped into virtual systems, and then managed independently of each other. For example, if you define virtual systems for the interfaces associated with specific departments or customers, you can then customize the administrative access, security policies, and logging/reporting for each department or customer.

You can also define administrator accounts that provide administrative or view-only access to a single virtual system. Initially, all interfaces, zones, and policies belong to the default virtual system (vsys1). When you enable multiple virtual systems, note the following:

  • Interfaces, zones, VLANs, virtual wires, and virtual routers (VR) must be assigned to a virtual system (a virtual system column is added to the respective pages).
  • A virtual system drop-down list is added under the Policies and Objects tabs. Before defining a policy or policy object, you must select the appropriate virtual system.
  • Remote logging destinations (SNMP, Syslog, and email), as well as applications, services, and profiles, can be shared by all virtual systems or limited to a selected virtual system.
  • Virtual router(s), security zone(s) and VLAN(s) can be defined before creating the vsys or can be added in a later stage by specifying the vsys when the resource is created.

Before configuring virtual systems, they will need to be activated. Activation is done under the device tab from the Setup > Management tab > General settings page. Once the virtual systems feature is enabled, ‘virtual systems’ and ‘shared gateway’ menu items become available in the left tree menu under the device tab. A minimum amount of information is required to begin configuring the first virtual system. Note that vs ys1 is the default virtual system which is always present.

| improve this answer | |
  • Yes, I saw that article and besides that article there is no documentation which explains the connection between VR and Vsys. There are many use cases in which there is no logic in assigning the VR to a Vsys for example: * VR can serve multiple Vsys * VR that is connected only to VRs In the Palo Alto device, you can create a VR connect it to a Vsys and not assign it to any Vsys. Am I missing something... Thanks, Zac67 for your help – Zorik Meyman Dec 27 '18 at 9:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.