VSYS-Specific Service Routes

In multi-tenant deployments where each customer is in a separate VSYS, you might want to configure different service routes for each tenant.  Starting with PAN-OS 7.0, we introduce this feature, which allows customers to configure service routes for individual virtual systems.

You will find the configuration under the Device tab > Setup > Services.  Notice the extra tab 'Virtual Systems' in the screenshot below:

Virtual Systems Tab

In the 'Location' drop-down menu, you can select the VSYS you want to configure a service route for.  Select the VSYS you want to edit and click the 'Service Route Configuration' link.  You will get a popup where you have 2 choices, as seen in the screenshot below:

VSYS Service Route Configuration

By selecting the 'Customize' radio button, you will see all the services for which a VSYS-specific service route is possible. Notice, in the example below, that I have configured a VSYS-specific service route for Syslog:

Syslog VSYS Specific Service Route

If you don't configure a specific service route, then it will inherit the global setting.  On the IPv6 tab, you can select the same services except for SNMP Trap:

IPv6 Services

Notice that it is NOT possible to configure a destination-based VSYS-specific service route.  As seen in the screenshot below, this is possible only in the global service route configuration.  Also notice that the global service route configuration has more services you can configure a service route for:

Global Service Route Configuration

Cheers!

-Kim