Creating subinterfaces The first step is to remove the IP configuration from the physical firewall. There are infrequent issues with them and I have some questions: What are the tools for trouble shooting Aggregate Interfaces within the GUI (web interface) What are the CLI commands for trouble shooting Aggregate interfaces. Type switchport access vlan 40 to assign this port to VLAN 30. Click on the name of the port ethernet1/7 and select the following: Interface Type: Aggregate Ethernet. Select the subnet. 'ish. Enter the VLAN Tag to differentiate between the subinterfaces. Web UI: CLI: # set network interface aggregate-ethernet <value> Aggregate interface name: ae1 - ae4 Set the aggregate ethernet interface type as layer2 or layer3: Web UI: CLI: # set network interface aggregate-ethernet ae1 + comment comment Last Updated: Oct 23, 2022. Exclude a Server from Decryption for Technical Reasons. PAN supports sub-interfaces on aggregate interfaces. 05-17-2020 10:08 AM. Aggregate Ethernet Interface is configured with LACP enabled. Aggregation of 10Gbps XFP and SFP+ is also supported. However, it is down on the Passive Firewall Passive Link State ( Under Device> High Availability> General > Active/Passive Settings) is enabled on both firewalls and members of the AE Interface are up on the Passive Firewall. Select Network Interfaces Ethernet , highlight the aggregate interface, such as ae1, and click Add Subinterface at the bottom of the screen. AE interface is up on the the Active Firewall. Alternatively, for the aggregate group, create a subinterface that uses DHCP to get its address. When aggregation interface ae1.2 on the Palo Alto Firewall is configured to be part of the DMZ Security Zone , all networks learnt by the OSPF routing protocol on interface ae1.2 will be. PAN-OS 4.0 introduced a new form of layer 3 subinterface known as an untagged subinterface. Server Monitor Account; Server Monitoring; Client Probing; Palo Alto Networks User-ID Agent Setup. Current Version: 9.1. An excerpt from Panos Admin guide: "Aggregate interface groups allow you to generate more than 1 Gbps aggregate throughput by using 802.3ad link aggregation of multiple 1 Gbps links. A Layer 3 aggregated link has been created between the Palo Alto Firewall (Interface ae1 on each firewall) and the Cisco 4507R+E Switch (Port-Channel 1 & 2). Go to Network > Interface and click on Add Aggregate Group. Layer 3 Subinterface; Log Card Interface; Log Card Subinterface; Decrypt Mirror Interface; Aggregate Ethernet (AE) Interface Group . Configure the subinterface. Open the interface configuration. Select Network Interfaces Ethernet , highlight the aggregate interface, such as ae1, and click Add Subinterface at the bottom of the screen. This allows a Palo Alto firewall to act as the default gateway for a Layer. L1 Bithead. To check if the ports are assigned, enter the command show vlan. Click Delete. Palo Alto Networks Predefined Decryption Exclusions. Our internal user Internet traffic also traverses this firewall. Navigate to the Network tab. Since PAN-OS version 6.1 the Palo Alto Networks firewall supports LACP, the Link Aggregation Control Protocol which bundles physical links to a logical channel. According to the diagram, the port Gi0/2 will be the port trunking. Enable Untagged Subinterface. Network > Interfaces; Aggregate Ethernet (AE) Interface Group; Download PDF. Select Network Interfaces Ethernet and click the interface name to edit it. I have the following configured: on the physical interface I am using 192.168..1/24 which is VLAN 1 created two sub interfaces for each VLAN subinterface .44 tagged 44 IP address 172.20.44.1/23 sub interface .120 tagged 120 IP address 172.2. panos_aggregate_interface - configure aggregate network interfaces; panos_api_key - retrieve api_key for username/password combination; panos_bgp_aggregate - Configures a BGP Aggregation Prefix Policy; panos_bgp_auth - Configures a BGP Authentication Profile; panos_bgp_conditional_advertisement - Configures a BGP conditional advertisement Create Untagged subinterfaces and assign them a different virtual router and zone. Similarly click on the name of the port ethernet1/8 and select the following: For Interface Name , enter a number after the period, such as 107. 1. Steps Create an aggregate group. Select the Link Speed , Link Duplex , and For a Layer 2 interface: Aggregate Group: select ae1 just created. Consider one example where each tenant's traffic egresses the firewall where the next hop is an ISP router. Environment How to create a sub-interface in Palo Alto Firewall and set up a Vlan I have a switch that is allowing all VLAN 1, 44, and 120. set network interface ethernet ethernet1/2 layer3 units ethernet1/2.30 tag 30 ip 192.168.30.1/24. Select the Aggregate Group you just defined. panos_aggregate_interface - configure aggregate network interfaces; panos_api_key - retrieve api_key for username/password combination; panos_bgp_aggregate - Configures a BGP Aggregation Prefix Policy; panos_bgp_auth - Configures a BGP Authentication Profile; panos_bgp_conditional_advertisement - Configures a BGP conditional advertisement Perform port assignment by going to Network> Interface. Steps Go to Network > Interfaces. Untagged subinterfaces are used in multi-tenant environments where each tenant's traffic must leave the firewall without VLAN tags. From the WebGUI, go to Network > Interfaces link. Access to config mode and enter the command interface FastEthernet0/2 to enter this port. Configure Interfaces; Configure an Aggregate Interface Group; Download PDF. My environment has Palo Alto Firewalls that has Aggregate Interface configuration and use. Go to Interfaces on the left pane. Assign interfaces to the aggregate group. Select Palo Alto calls it "Aggregate Interface Group" while Cisco calls it EtherChannel or Channel Group. I configured LACP for two ports connected from a Palo Alto firewall to a Cisco switch. The untagged L3 subinterfaces are designed to work without ip-address on the physical device. We can now go ahead and add a subinterface. Last Updated: Oct 24, 2022. . Select a physical interface. Next choose L3 or L2 interface (should be highlighted as shown in above pic for ethernet1/6) and then click on Add subinterface. Create subinterface CLI. On the PAs I tried to replicate this configuration by creating an AE interface with 2 sub interfaces - one in each VSYS. Setting up a new physical interface can be cumbersome because you first have to get them cabled up and then you even need to be lucky enough to have an inter. For the aggregate group, create a subinterface that uses a static IP address. Version 10.1; Version 10.0 (EoL) Version 9.1; Version 9.0 (EoL) . We currently have a L3 interface on our core switch that is cabled to a L3 interface on each firewall which serves as the "inside" interface. Configure trunking. Is there a way to create a sub-interface via CLI? Perform the following steps for each interface (1-8) that will be a member of the aggregate group. Steps To terminate multiple VLANS on the same physical interface, multiple tagged sub-interfaces need to be created (one per VLAN). Set the Interface Type to Aggregate Ethernet . This document provides steps on how to configure Layer 3 untagged subinterfaces. Navigate to the IPv4 tab. For the aggregate group, create a subinterface that uses a static IP address. In this video, we take a look at layer 3 subinterfaces on the Palo Alto Firewall. 5.7. Click OK.