# Add logical interfaces

Logical interface elements allow you to group interfaces together according to network segment and interface type.

##

Logical interfaces are used in the configuration of the following types of interfaces to represent one or more network interfaces:

- Capture interfaces on Engines, IPS Engines, and Layer 2 Engines
- Inline interfaces on IPS engines and Layer 2 Engines
- Inline IPS interfaces on Engines
- Inline Layer 2 Engine interfaces on Engines

You cannot use the same logical interface to represent both capture interfaces and inline interfaces on the same engine. On Engines, you cannot use the same logical interface to represent both inline IPS interfaces and inline Layer 2 Engine interfaces. Otherwise, a logical interface can represent any number or combination of physical interfaces or VLAN Interfaces.

There is one predefined logical interface element called default_eth. If you want to create both capture interfaces and inline interfaces on the same Security Engine, you must add at least one more logical interface.

On IPS engines and Layer 2 Engines, a logical interface element called System Communications is automatically assigned to interfaces that have an IP address that is used as the primary or backup Control IP address. You can use the System Communications logical interface to represent all Control IP addresses in IPS and Layer 2 Engine Policies.

Note: You cannot use the System Communications logical interface on engines for Capture interfaces, Inline IPS interfaces, or Inline Layer 2 Engine interfaces.

You can use logical interfaces in IPS Policies, Layer 2 Engine Policies, and Layer 2 Interface Policies to limit the scope of your rules. You can use logical interfaces to create rules that match based on which interface the traffic was picked up from. For example, you can create a different logical interface for each VLAN and use them to create rules that apply only to traffic from a specific VLAN.

For more details about the product and how to configure features, click Help or press F1.

## Steps

1. Select Engine.
2. Browse to Other Elements.
3. Right-click Logical Interfaces, then select New Logical Interface.
4. Configure the settings, then click OK.

## Logical Interface Properties dialog box

Use this dialog box to define the properties of a Logical Interface.

Option | Definition
--- | ---
Name | The name of the element.
Comment (Optional) | A comment for your own reference.
View interface as one LAN | When selected, the engine treats VLANs associated with the Logical Interface as a single LAN. We recommend selecting this option only for capture interfaces in IDS deployments. Note: Selecting this option for inline interfaces can cause the Security Engine to treat the TCP time stamp of some TCP packets as invalid and drop TCP packets in some environments. The Security Engine might consider the TCP time stamp invalid if the same traffic passes through the Security Engine multiple times through the same inline interface.