SCM Essentials - No interfaces in Routing and Zones

[jordan]

Hi There,
Sorry if this is a stupid question, its my first palo alto deployment in Strata Cloud manager.

I have configured several layer3 interfaces and sub-interfaces and pushed them down to the firewall.

However when I go to create Zones and attach them to a Virtual Router, I have no options for interfaces.

I tried manually typing out the interface name and its showing as not a valid reference.

I have no issues when trying to configure locally.

Just unsure if I'm missing something.

[MHebert2022]

Did you ever resolve this?  I am having the same issue.

[jordan]

Hey @MHebert2022 

Yes I did, the issue stems from no variable being created when creating the interface in the folder/firewall configuration. If you do the base config (i just done type, name, tag) in a snippet and then associate the snippet to the firewall, it creates a variable that can then be assigned to the routing objects in the firewall config.

Palo Alto support were great in solving this behavior and assured me that it is, in fact, a stupid behavior.

Hit me up if you need screenshots etc,

Jordan 🙂 

[MHebert2022]

Thanks for the quick response, and perfect timing, as I am trying to fix this right now.  I will definitely take you up on the screen shot. Thanks!

[jordan]

Sorry for the delay, I'm in NZ, i was asleep.
Here we go!!
In the config scope, change to snippets and add a new snippet.

In the snippet configuration, head over to network and interfaces.

Add the new interfaces.

From the new interface/sub interface etc, setup any settings required. From here i create the interface (which creates the variable $ether1-20), the comment and the management profile. I do the rest (ip, port specific settings, zone, router etc) at the firewall config level.

The Variable created $ether1-20 is what gets assigned to the VR and zones either in the snippet config or in the firewall config.

From the snippet overview, change the settings for the snippet association and assign it to the firewall your configuring.

Once associated, you will see the snippet config changes made show on the candidate config for the associated firewalls, and then you can add the new interfaces to zones and VR's by the associated variable.

[MHebert2022]

Thank you so much!  This is great!