Can't add tunnel interface created by restapi, to Security Zone using restapi.

[I.Miller]

Using restapi to create IPSec tunnels for a new firewall attached to Panorama. 

I create the tunnel interface using restapi. I can see the new interface successfully created in Panorama. 

When I try to assign that interface to a Security Zone it fails with: 

"Invalid Object:  Branch-VPN -> network -> layer3 'tunnel.781' is not a valid reference.  Branch-VPN -> network -> layer3 is invalid."

From Panorama I try to edit the security zone and add the interface but it isn't available on the drop down list.

If I open the tunnel.781 interface and click close from Panorama, the interface then is available in the drop down list and I can successfully run the restapi process. 

What is the web interface doing when you open the tunnel interface object, make no changes, then close it and how do I do it with restapi?

[JayGolf]

Hi @I.Miller ,

When you open and close an object by clicking "OK" in the GUI, FW/Panorama seems to perform an internal validation or synchronization process that registers the object in the system. I've encountered similar behavior when using scripting mode and pasting a large series of set commands. I once had to "OK" a whole new config of over 500 objects so I understand the frustration. 

If you want to handle this primarily via the API, I suggest trying a commit after creating the object, before attempting to attach it to another configuration (like a zone). This might help ensure that the object is fully registered and available for further assignments.