Why are external zones required to be configured on a Palo Alto Networks NGFW in an environment with multiple virtual systems?

The primary purpose of external zones is to facilitate internal routing between VSYSs; while traffic might eventually leave the appliance, the 'while the traffic is leaving the appliance' clause misrepresents their core function for inter-VSYS communication.

Although external zones can represent shared networks, their *requirement* is driven by the need to enable communication between separate virtual systems, not merely their reusability across VSYSs.

External zones are a specific configuration element used in a multi-VSYS setup to route traffic logically between zones belonging to different virtual systems. This functionality enables inter-VSYS communication without the need for traffic to physically exit and re-enter the firewall appliance, maintaining internal segmentation.

Only a single external zone is typically required per virtual system to act as a gateway for inter-VSYS routing, not multiple external zones within each virtual system.