StudyToCert

All certifications / NGFW Engineer / Lessons

Palo Alto Networks Certified Next-Generation Firewall Engineer NGFW-Engineer · Domain 2: PAN-OS device setting configuration

Virtual systems: vsys creation, interfaces/zones/routers per vsys, shared gateway, inter-vsys traffic via external zones

▶ Watch the overview video

Last reviewed September 30, 2026 · Leer en español

Virtual systems (vsys) split one physical firewall into several logical firewalls, each with its own interfaces, zones, policies, objects and administrators. Service providers use them for tenants, and enterprises use them to separate business units that need independent policy and separate administration on shared hardware. Every firewall runs vsys1 even when you never see it, so everything you configure on a single-vsys firewall already lives in vsys1.

Free account

Keep reading for free

Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 6 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.

Sign up free Log in

Study NGFW Engineer for free
A week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Open the NGFW Engineer study plan