Set zone via CLI does not work

[davistg]

admin@firewall(active)# set vsys vsys1 zone test network layer3 ethernet1/17.66

Server error : layer3 'ethernet1/17.66' is not a valid reference

[TomYoung]

Hi @davistg ,

Did you create the zone first with the "set vsys vsys1 zone test" command?  Also, you will need to create interface ethernet1/17.66  as a layer3 interface if it doesn't already exist.  Then, your command should work.

Thanks,

Tom

[treeef]

I had the same issue. Here is the solution: https://live.paloaltonetworks.com/t5/general-topics/panorama-cli-command-to-add-a-tunnel-interface-t...

You have to import the interface into the vsys before the Zone will "see" it and be able to be assigned to it

set config vsys vsys1 import network interface ethernet1/1.1001

Here is a full set of steps to create new ethernet subinterface, for example, and assign it to the myZone zone:

# Create subinterface w/ vlan tag, mgmt profile, comment, and IP address
set config network interface ethernet ethernet1/1 layer3 units ethernet1/1.1001 tag 1001 interface-management-profile "Ping" comment "Interface" ip 192.168.100.1/24

# Set the virtual router for the new interface
set config network virtual-router default interface ethernet1/1.1001

# Import the new interface into the vsys (so the Zone can see it as an available interface to add)
set config vsys vsys1 import network interface ethernet1/1.1001

# Set the Zone for the new interface
set config vsys vsys1 zone MyZone network layer3 ethernet1/1.1001

# (Optional, but helpful in many scenarios) Set up DHCP relaying to an existing DHCP server (saved in variable $DHCPSERVER)
set config network dhcp interface ethernet1/1.1001 relay ip server $DHCPSERVER enabled yes