To enable communication between virtual systems (vsys) that use separate virtual routers (VRs), three key configurations are required, in addition to security policies. First, the virtual systems must be configured to be "visible" to each other, which is a prerequisite for any inter-vsys interaction. Second, an "external" zone must be created in the source vsys, and the interface belonging to the destination vsys must be added to it. This logically connects the two systems. Third, a static route must be configured in the source VR with a next-hop type of next-vr, specifying the destination VR to which the traffic should be forwarded.

B: While the zones will be Layer 3, the specific type required for inter-vsys communication is an "external" zone. This option is not precise enough.

C: A next-hop of "none" is used for discard routes or for traffic destined for a directly connected network, not for routing between virtual routers.

1. Palo Alto Networks Documentation (PAN-OS® Administrator's Guide 10.2): The section "Configure Inter-VSYS Routing" outlines the precise steps.

Step 1: Make Virtual Systems Visible to One Another: "Before you can route traffic between virtual systems

you must make them visible to one another." This supports option E.

Step 2: Configure an External Zone and Add an Interface: "Create a zone of the type External... An external zone allows you to route traffic between virtual systems." This supports option A.

Step 3: Configure a Static Route with a Next Hop of next-vr: "Create a static route to forward traffic from the source virtual router... to the destination virtual router... For Next Hop

select next-vr and select the destination virtual router." This supports option D.

Source: Palo Alto Networks

"PAN-OS® Administrator's Guide 10.2

" Chapter: Virtual Systems

Section: Configure Inter-VSYS Routing.

2. Palo Alto Networks Documentation (PAN-OS® New Features Guide 8.1): The introduction of the next-vr option is detailed here

reinforcing its specific purpose.

"You can now configure a static route to direct traffic between two virtual routers (VRs) on the same firewall... To support this inter-VR routing

a new next hop type

next-vr

is available for IPv4 and IPv6 static routes." This directly validates the specific mechanism in option D.

Source: Palo Alto Networks

"PAN-OS® New Features Guide 8.1

" Chapter: Networking Features

Section: Static Route Next Hop for Inter-VR Routing.