topic Re: Disable a tunneling interface ? in General Topics

Disable a tunneling interface ?

novidys — Fri, 03 Dec 2010 16:09:03 GMT

Hi all,

Is there a CLI command to disable (shutdown) a tunnel interface on a PAN firewall ?

Thank you

Regards

Re: Disable a tunneling interface ?

jnguyen — Fri, 03 Dec 2010 17:38:48 GMT

there is currently no command to disable a tunnel interface.

Re: Disable a tunneling interface ?

tarkawa — Tue, 28 Feb 2012 18:10:11 GMT

Is there one now

If not, I have a work-around. Will post next as attachment.

Re: Disable a tunneling interface ?

mikand — Tue, 28 Feb 2012 19:51:49 GMT

WTF a cliffhanger? 😃

Re: Disable a tunneling interface ?

tarkawa — Tue, 28 Feb 2012 21:08:35 GMT

Patience, Daniel-san...

Re: Disable a tunneling interface ?

Retired Member — Wed, 29 Feb 2012 06:13:54 GMT

Curious why you want to shutdown a tunnel interface. This is a logical interface and not really tied to a physical interface as such. What are you trying to accomplish by shutting down tunnel interface?

Having said that, you can enable tunnel monitoring as that can basically disable the tunnel interface if the VPN is down to influence routing protocols. Is that what you are trying to do?

-Richard

Re: Disable a tunneling interface ?

tarkawa — Wed, 29 Feb 2012 17:15:18 GMT

Many reasons, but I'll give the two, which I'm using it for right now. First, is a VPN between client(s) and myself. I don't want to leave it up at all times, just bring it up when needed. This will relieve routing conflicts between overlapping schemes among different clients and myself. Second, we moved from an old VPN between a Cisco (remote device) on one side and PA on the other to a complete Palo Alto solution. I want to avoid any chance of traffic routing over the old VPN and the only way to ensure this is to disable it, but PA doesn't allow an admin down state like Cisco does, BTW, why is that? SOP to leave the old infra in place until the new is proven good and stable. If a problem arises, simply fall back to the old VPN.

Re: Disable a tunneling interface ?

tarkawa — Wed, 07 Mar 2012 18:15:57 GMT

::crickets::

Re: Disable a tunneling interface ?

mikand — Wed, 07 Mar 2012 22:39:36 GMT

I guess you would just bitchslap me if I returned your "Patience, Daniel-san..."? 😉

Re: Disable a tunneling interface ?

tarkawa — Wed, 07 Mar 2012 23:19:13 GMT

LOL! two-shay... Then I would say, damn you guys are slow... ha

Re: Disable a tunneling interface ?

pablo_endres — Wed, 22 Aug 2012 13:08:37 GMT

Hi,

This is a rather old thread, but did someone find a way to get this done?

I was thinking of doing a shutdown of the tunnel interface or to the tunnel but couldn't find a way to do it.

Re: Disable a tunneling interface ?

pablo_endres — Thu, 23 Aug 2012 12:08:08 GMT

My workaround is the following:Block all IPSEC traffic to/from the termination point

It is not nice, but it works

Re: Disable a tunneling interface ?

Scott_Farwell — Wed, 07 Dec 2022 21:02:50 GMT

Since I didn't see anyone providing a solution i just chose "disable" for each tunnel in the GUI and then did a commit.

The 3 tunnels went RED for status but IKE is still green which makes no sense.

It seems there should be a simple CLI command like "test vpn tunnel tunnelname" (stop/start disable/enable) to do this easily but nobody suggested one so i assume one does not exist.

I have 2 customers we have stopped supporting so I wanted to disable the tunnels.

If they resume support/buy new products then I will just enable it instead of going through the whole tunnel building process.

Re: Disable a tunneling interface ?

Phil_Benner — Tue, 17 Oct 2023 16:29:41 GMT

Winner Winner Chicken Dinner!