topic Re: Set zone via CLI does not work in General Topics

Set zone via CLI does not work

davistg — Sun, 21 Nov 2021 20:48:44 GMT

admin@firewall(active)# set vsys vsys1 zone test network layer3 ethernet1/17.66

Server error : layer3 'ethernet1/17.66' is not a valid reference

Re: Set zone via CLI does not work

TomYoung — Sun, 21 Nov 2021 21:19:16 GMT

Did you create the zone first with the "set vsys vsys1 zone test" command? Also, you will need to create interface ethernet1/17.66 as a layer3 interface if it doesn't already exist. Then, your command should work.

Thanks,

Tom

Re: Set zone via CLI does not work

treeef — Fri, 11 Apr 2025 17:23:15 GMT

I had the same issue. Here is the solution: https://live.paloaltonetworks.com/t5/general-topics/panorama-cli-command-to-add-a-tunnel-interface-to-a-zone/td-p/138404

You have to import the interface into the vsys before the Zone will "see" it and be able to be assigned to it

set config vsys vsys1 import network interface ethernet1/1.1001

Here is a full set of steps to create new ethernet subinterface, for example, and assign it to the myZone zone:

# Create subinterface w/ vlan tag, mgmt profile, comment, and IP address set config network interface ethernet ethernet1/1 layer3 units ethernet1/1.1001 tag 1001 interface-management-profile "Ping" comment "Interface" ip 192.168.100.1/24 # Set the virtual router for the new interface set config network virtual-router default interface ethernet1/1.1001 # Import the new interface into the vsys (so the Zone can see it as an available interface to add) set config vsys vsys1 import network interface ethernet1/1.1001 # Set the Zone for the new interface set config vsys vsys1 zone MyZone network layer3 ethernet1/1.1001 # (Optional, but helpful in many scenarios) Set up DHCP relaying to an existing DHCP server (saved in variable $DHCPSERVER) set config network dhcp interface ethernet1/1.1001 relay ip server $DHCPSERVER enabled yes

Re: Set zone via CLI does not work

AdamGoepel-Stillman — Thu, 24 Jul 2025 22:40:37 GMT

Logging in to say thank you.

Re: Set zone via CLI does not work

treeef — Fri, 25 Jul 2025 12:26:08 GMT

Thanks! You're quite welcome and I'm glad it was helpful.