https://live.paloaltonetworks.com/t5/next-generation-firewall/associating-link-tags-with-gre-tunnels-for-sd-wan-path-control/m-p/1227460#M5825 <P class="" data-start="164" data-end="365">We are configuring SD-WAN path control on a Palo Alto Networks PA-1410 (PAN-OS 11.4) that connects to two Zscaler data centers (Dallas and Atlanta) over two ISP circuits. Four GRE tunnels are in place:</P> <UL data-start="367" data-end="462"> <LI class="" data-start="367" data-end="390"> <P class="" data-start="369" data-end="390">ISP 1 → Zscaler DFW</P> </LI> <LI class="" data-start="391" data-end="414"> <P class="" data-start="393" data-end="414">ISP 1 → Zscaler ATL</P> </LI> <LI class="" data-start="415" data-end="438"> <P class="" data-start="417" data-end="438">ISP 2 → Zscaler DFW</P> </LI> <LI class="" data-start="439" data-end="462"> <P class="" data-start="441" data-end="462">ISP 2 → Zscaler ATL</P> </LI> </UL> <P class="" data-start="464" data-end="579">To steer traffic, we have already created the following Link Tags and added them to a Traffic Distribution Profile:</P> <UL data-start="581" data-end="690"> <LI class="" data-start="581" data-end="608"> <P class="" data-start="583" data-end="608"><STRONG data-start="583" data-end="606">ZIA-Tunnel-ISP1-DFW</STRONG></P> </LI> <LI class="" data-start="609" data-end="636"> <P class="" data-start="611" data-end="636"><STRONG data-start="611" data-end="634">ZIA-Tunnel-ISP1-ATL</STRONG></P> </LI> <LI class="" data-start="637" data-end="664"> <P class="" data-start="639" data-end="664"><STRONG data-start="639" data-end="662">ZIA-Tunnel-ISP2-DFW</STRONG></P> </LI> <LI class="" data-start="665" data-end="690"> <P class="" data-start="667" data-end="690"><STRONG data-start="667" data-end="690">ZIA-Tunnel-ISP2-ATL</STRONG></P> </LI> </UL> <P class="" data-start="692" data-end="865">Our next step is to map each Link Tag to its corresponding GRE tunnel, but we can’t locate the configuration element that performs this association in either the GUI or CLI.</P> <P class="" data-start="867" data-end="1084">Could you please share any documentation, configuration examples, or best-practice advice on linking (binding) Link Tags to individual GRE tunnels within the SD-WAN settings? Any guidance would be greatly appreciated.<BR />Please see attached screenshot for the current configuration.(IP address is temporary ones)</P> <P class="" data-start="1086" data-end="1120">Thank you very much for your help.</P> Fri, 25 Apr 2025 18:23:36 GMT maintsst 2025-04-25T18:23:36Z https://live.paloaltonetworks.com/t5/next-generation-firewall/associating-link-tags-with-gre-tunnels-for-sd-wan-path-control/m-p/1227460#M5825 <P class="" data-start="164" data-end="365">We are configuring SD-WAN path control on a Palo Alto Networks PA-1410 (PAN-OS 11.4) that connects to two Zscaler data centers (Dallas and Atlanta) over two ISP circuits. Four GRE tunnels are in place:</P> <UL data-start="367" data-end="462"> <LI class="" data-start="367" data-end="390"> <P class="" data-start="369" data-end="390">ISP 1 → Zscaler DFW</P> </LI> <LI class="" data-start="391" data-end="414"> <P class="" data-start="393" data-end="414">ISP 1 → Zscaler ATL</P> </LI> <LI class="" data-start="415" data-end="438"> <P class="" data-start="417" data-end="438">ISP 2 → Zscaler DFW</P> </LI> <LI class="" data-start="439" data-end="462"> <P class="" data-start="441" data-end="462">ISP 2 → Zscaler ATL</P> </LI> </UL> <P class="" data-start="464" data-end="579">To steer traffic, we have already created the following Link Tags and added them to a Traffic Distribution Profile:</P> <UL data-start="581" data-end="690"> <LI class="" data-start="581" data-end="608"> <P class="" data-start="583" data-end="608"><STRONG data-start="583" data-end="606">ZIA-Tunnel-ISP1-DFW</STRONG></P> </LI> <LI class="" data-start="609" data-end="636"> <P class="" data-start="611" data-end="636"><STRONG data-start="611" data-end="634">ZIA-Tunnel-ISP1-ATL</STRONG></P> </LI> <LI class="" data-start="637" data-end="664"> <P class="" data-start="639" data-end="664"><STRONG data-start="639" data-end="662">ZIA-Tunnel-ISP2-DFW</STRONG></P> </LI> <LI class="" data-start="665" data-end="690"> <P class="" data-start="667" data-end="690"><STRONG data-start="667" data-end="690">ZIA-Tunnel-ISP2-ATL</STRONG></P> </LI> </UL> <P class="" data-start="692" data-end="865">Our next step is to map each Link Tag to its corresponding GRE tunnel, but we can’t locate the configuration element that performs this association in either the GUI or CLI.</P> <P class="" data-start="867" data-end="1084">Could you please share any documentation, configuration examples, or best-practice advice on linking (binding) Link Tags to individual GRE tunnels within the SD-WAN settings? Any guidance would be greatly appreciated.<BR />Please see attached screenshot for the current configuration.(IP address is temporary ones)</P> <P class="" data-start="1086" data-end="1120">Thank you very much for your help.</P> Fri, 25 Apr 2025 18:23:36 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/associating-link-tags-with-gre-tunnels-for-sd-wan-path-control/m-p/1227460#M5825 maintsst 2025-04-25T18:23:36Z