topic When to use zone type Tunnel in General Topics

When to use zone type Tunnel

Ismailsh — Thu, 06 Feb 2025 15:29:14 GMT

I am setting up a lan to lan tunnel between my palo alto firewall and another palo alto device. When I look at the documentation online, they suggest I create a new zone and set the type to "layer3". But I also see a type "Tunnel" in there. I would like to understand , should I select Tunnel or Layer3 for the zone that will be applied to the VPN tunnel?

Below are the documents I have read from Palo Alto. I would like to ask what have you selected as the zone type and why for VPN tunnel.

https://live.paloaltonetworks.com/t5/next-generation-firewall/zone-types-interface-types-tap-mode-virtual-wire-firewall/td-p/548416

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGkCAK

https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/set-up-site-to-site-vpn/set-up-ipsec/set-up-an-ipsec-tunnel

Thanks.

Re: When to use zone type Tunnel

Brandon_Wertz — Thu, 06 Feb 2025 15:53:19 GMT

@Ismailsh wrote:

I am setting up a lan to lan tunnel between my palo alto firewall and another palo alto device. When I look at the documentation online, they suggest I create a new zone and set the type to "layer3". But I also see a type "Tunnel" in there. I would like to understand , should I select Tunnel or Layer3 for the zone that will be applied to the VPN tunnel?

Below are the documents I have read from Palo Alto. I would like to ask what have you selected as the zone type and why for VPN tunnel.

https://live.paloaltonetworks.com/t5/next-generation-firewall/zone-types-interface-types-tap-mode-virtual-wire-firewall/td-p/548416

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGkCAK

https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/set-up-site-to-site-vpn/set-up-ipsec/set-up-an-ipsec-tunnel

Thanks.

At the end of your day it's about your security intent. You have 2 locations each with their own local "LANs" or "trust" zones. Connecting these 2 locations, how did you want to apply security policy between traffic which flows between these 2 locations?

If you put the tunnel in the same zone as the respective site LAN zone then you're essentially calling both sites the same security layer. If you want to start off with a more restrictive security policy then use a new/unique security zone at each location that the tunnel will be apart of.

Re: When to use zone type Tunnel

Ismailsh — Thu, 06 Feb 2025 16:12:08 GMT

Hi Brendan,

Thanks for the reply. What I want to understand is what should I set the type of the zone. Should I select layer3 or Tunnel. What is the difference between the two? Please see attached screenshot of the types in zone.

Re: When to use zone type Tunnel

agoussei8 — Mon, 01 Sep 2025 16:19:29 GMT

Hello,

You should use a L3 zone type for your VPN tunnel. The Tunnel zone type is not used for any interface, as it is intended for use in a feature named "Tunnel Content Inspection". More information here: https://docs.paloaltonetworks.com/ngfw/networking/tunnel-content-inspection/tunnel-content-inspection-overview

A snippet from the article above:

You can configure a tunnel zone, which gives you the flexibility to configure Security policy rules for inside content that differs from the Security policy rules for the tunnel. If you use a different tunnel inspection policy for the tunnel zone, it must always have a maximum tunnel inspection level of two levels because by definition the firewall is looking at the second level of encapsulation.

Hope that helps.