topic Re: Can not change in Next-Generation Firewall Discussions

Can not change

Habte-01 — Thu, 18 Aug 2022 15:11:32 GMT

Hello Every one

I was trying to build a Site to Site Vpn. I can only select limited interfaces when creating a new Zone. The selection option does not even include the main gateway interface (Ethernet1/10. I have attached a screen shoot of the scenario.

Re: Can not change

PavelK — Thu, 18 Aug 2022 21:49:36 GMT

Hello @Habte-01

the interfaces you are not able to see in drop down list, are they configured as a Type Layer 3 and are they assigned to Virtual Router?

Kind Regards

Pavel

Re: Can not change

Habte-01 — Fri, 19 Aug 2022 19:03:39 GMT

Yes they all are on Vr1 and layer3

Re: Can not change

PavelK — Mon, 22 Aug 2022 00:17:45 GMT

Thank you for reply @Habte-01

this should be all you need to get an interface available in a zone. An interface can be a member of only one zone. Is the interface you are trying to add already member of existing zone?

Kind Regards

Pavel

Re: Can not change

Habte-01 — Mon, 22 Aug 2022 13:41:47 GMT

Thanks Pavel. No it is not.

Re: Can not change

PavelK — Sun, 28 Aug 2022 00:04:39 GMT

Thank you for reply @Habte-01

I am running out of ideas. Could you please confirm what PAN-OS are you running? I would like to see I can re-produce it by using the same version.

Kind Regards

Pavel

Re: Can not change

MRdot1here — Mon, 29 Aug 2022 18:02:50 GMT

Hello Bithead, you might need to create a new interface type "Tunnel" first for the VPN site to site (IPSec ) connection. Then you would want to add it to the desire new or existing zone. I've recently connected 3 sites and I wrote the necessary steps I used to build such connections. I am sharing the steps below, in case is useful:

Steps to create IPSecVPNTunnel:
1. Create the tunnel interface

2. Add the tunnel to a zone.
3. Create the IKE Crypto Profile
4. Create IPSec Crypto Profile
5. Create IKE Gateways
6. Create IPSec Tunnel
7. Create Virtual router static route with the tunnel as the tunnel just created as the interface, define what routes need access.
8. Create the source and destination security policies to define the source and destination and who to allow access.

Kind regards,

Maria.