topic Re: Panorama CLI command to add a tunnel interface to a zone in General Topics

Panorama CLI command to add a tunnel interface to a zone

HarshadSowani — Thu, 19 Jan 2017 19:18:57 GMT

Trying to use the Panorama CLI to edit a template and add a tunnel interface, and also assign it to an existing zone in the same template. Does anyone know the CLI command to do this?

I can add the tunnel interface and assign it to a virtual router like this:

configure
edit template myTemplate
set config network interface tunnel units tunnel.100 comment myTunnelInterface
set config network virtual-router default interface tunnel.100

But I cant find the CLI command to then assign a zone to this tunnel interface on the Panorama CLI. Any ideas?

Re: Panorama CLI command to add a tunnel interface to a zone

RFalconer — Thu, 19 Jan 2017 22:59:43 GMT

It's under the vsys config.

edit template myTemplate

set config vsys vsys1 zone .........

Re: Panorama CLI command to add a tunnel interface to a zone

HarshadSowani — Fri, 20 Jan 2017 00:34:44 GMT

I tried that, but the options under the vsys command dont include tunnel interfaces - only has layer2, layer3, tap, virtual-wire.

#set config vsys vsys1 zone myZone network

+ log-setting               Log setting for forwarding scan logs
+ zone-protection-profile   Zone protection profile
> layer2                    Layer2 interfaces
> layer3                    Layer3 interfaces
> tap                       Tap mode interfaces
> virtual-wire              Virtual-wire interfaces
  <Enter>                   Finish input

Even if i select layer3, i only see loopback, vlan or an option to add a list of values, which also comes back with "invalid reference" if i list my tunnel interface there.

# set config vsys vsys1 zone myZone network layer3
  [          Start a list of values.
  loopback   loopback loopback
  vlan       vlan vlan
  <value>    member value

# set config vsys vsys1 zone myZone network layer3 [tunnel.100]
Server error :  layer3 '[tunnel.100]' is not a valid reference

Re: Panorama CLI command to add a tunnel interface to a zone

RFalconer — Fri, 20 Jan 2017 01:02:57 GMT

You need to add tunnel.100 to vsys1 before it can be assigned a zone.

set config network interface tunnel units tunnel.100

set config vsys vsys1 import network interface tunnel.100

set config vsys vsys1 zone myZone network layer3 tunnel.100

Re: Panorama CLI command to add a tunnel interface to a zone

HarshadSowani — Fri, 20 Jan 2017 01:10:10 GMT

That was it! Thanks a lot for your help!