In order to route traffic between layer 3 interfaces on the PAN firewall you need:

VLANs (Virtual Local Area Networks) are Layer 2 constructs for segmenting broadcast domains and, while often used with Layer 3 interfaces (e.g., subinterfaces), do not perform the routing function themselves.

A Vwire (Virtual Wire) is a Layer 2 deployment mode where the firewall operates transparently, forwarding traffic between two interfaces without any Layer 3 routing or IP addressing, acting like a 'bump in the wire'.

A Security Profile applies various security inspections (e.g., Antivirus, Anti-Spyware) to traffic but does not perform the fundamental routing function required to move traffic between different Layer 3 networks.

A Virtual Router is a crucial component on a Palo Alto Networks firewall for enabling Layer 3 routing. It maintains routing tables, connects multiple Layer 3 interfaces, and makes decisions on how to forward traffic between different IP networks configured on those interfaces.