How many zones can an interface be assigned with a Palo Alto Networks firewall?