When to use zone type Tunnel

[Ismailsh]

I am setting up a lan to lan tunnel between my palo alto firewall and another palo alto device.  When I look at the documentation online, they suggest I create a new zone and set the type to "layer3".  But I also see a type "Tunnel" in there.  I would like to understand , should I select Tunnel or Layer3 for the zone that will be applied to the VPN tunnel?

Below are the documents I have read from Palo Alto.  I would like to ask what have you selected as the zone type and why for VPN tunnel.

https://live.paloaltonetworks.com/t5/next-generation-firewall/zone-types-interface-types-tap-mode-vi...

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGkCAK

https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/set-up-site-to-site-vpn/...

Thanks.

[Brandon_Wertz]

---

@Ismailsh wrote:

I am setting up a lan to lan tunnel between my palo alto firewall and another palo alto device.  When I look at the documentation online, they suggest I create a new zone and set the type to "layer3".  But I also see a type "Tunnel" in there.  I would like to understand , should I select Tunnel or Layer3 for the zone that will be applied to the VPN tunnel?

Below are the documents I have read from Palo Alto.  I would like to ask what have you selected as the zone type and why for VPN tunnel.

https://live.paloaltonetworks.com/t5/next-generation-firewall/zone-types-interface-types-tap-mode-vi...

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGkCAK

https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/set-up-site-to-site-vpn/...

Thanks.

---

At the end of your day it's about your security intent.  You have 2 locations each with their own local "LANs" or "trust" zones.  Connecting these 2 locations, how did you want to apply security policy between traffic which flows between these 2 locations?

If you put the tunnel in the same zone as the respective site LAN zone then you're essentially calling both sites the same security layer.  If you want to start off with a more restrictive security policy then use a new/unique security zone at each location that the tunnel will be apart of.

[Ismailsh]

Hi Brendan,

Thanks for the reply.  What I want to understand is what should I set the type of the zone.  Should I select layer3 or Tunnel.  What is the difference between the two?  Please see attached screenshot of the types in zone.