I have a switch that is allowing all VLAN 1, 44, and 120. 05-17-2020 10:08 AM. This document provides steps on how to configure Layer 3 untagged subinterfaces. We can now go ahead and add a subinterface. Click Delete. An excerpt from Panos Admin guide: "Aggregate interface groups allow you to generate more than 1 Gbps aggregate throughput by using 802.3ad link aggregation of multiple 1 Gbps links. To check if the ports are assigned, enter the command show vlan. How to create a sub-interface in Palo Alto Firewall and set up a Vlan Enable Untagged Subinterface. Perform port assignment by going to Network> Interface. Select Network Interfaces Ethernet and click the interface name to edit it. Steps Create an aggregate group. Server Monitor Account; Server Monitoring; Client Probing; Next choose L3 or L2 interface (should be highlighted as shown in above pic for ethernet1/6) and then click on Add subinterface. Perform the following steps for each interface (1-8) that will be a member of the aggregate group. Similarly click on the name of the port ethernet1/8 and select the following: Last Updated: Oct 24, 2022. . Aggregate Ethernet Interface is configured with LACP enabled. Palo Alto Networks User-ID Agent Setup. Assign interfaces to the aggregate group. set network interface ethernet ethernet1/2 layer3 units ethernet1/2.30 tag 30 ip 192.168.30.1/24. 5.7. Select the Aggregate Group you just defined. Consider one example where each tenant's traffic egresses the firewall where the next hop is an ISP router. For the aggregate group, create a subinterface that uses a static IP address. Select the Link Speed , Link Duplex , and Select Network Interfaces Ethernet , highlight the aggregate interface, such as ae1, and click Add Subinterface at the bottom of the screen. Configure trunking. I configured LACP for two ports connected from a Palo Alto firewall to a Cisco switch. Click on the name of the port ethernet1/7 and select the following: Interface Type: Aggregate Ethernet. This allows a Palo Alto firewall to act as the default gateway for a Layer. Current Version: 9.1. Since PAN-OS version 6.1 the Palo Alto Networks firewall supports LACP, the Link Aggregation Control Protocol which bundles physical links to a logical channel. L1 Bithead. I have the following configured: on the physical interface I am using 192.168..1/24 which is VLAN 1 created two sub interfaces for each VLAN subinterface .44 tagged 44 IP address 172.20.44.1/23 sub interface .120 tagged 120 IP address 172.2. Steps To terminate multiple VLANS on the same physical interface, multiple tagged sub-interfaces need to be created (one per VLAN). Type switchport access vlan 40 to assign this port to VLAN 30. AE interface is up on the the Active Firewall. For a Layer 2 interface: There are infrequent issues with them and I have some questions: What are the tools for trouble shooting Aggregate Interfaces within the GUI (web interface) What are the CLI commands for trouble shooting Aggregate interfaces. Configure Interfaces; Configure an Aggregate Interface Group; Download PDF. For the aggregate group, create a subinterface that uses a static IP address. On the PAs I tried to replicate this configuration by creating an AE interface with 2 sub interfaces - one in each VSYS. When aggregation interface ae1.2 on the Palo Alto Firewall is configured to be part of the DMZ Security Zone , all networks learnt by the OSPF routing protocol on interface ae1.2 will be. panos_aggregate_interface - configure aggregate network interfaces; panos_api_key - retrieve api_key for username/password combination; panos_bgp_aggregate - Configures a BGP Aggregation Prefix Policy; panos_bgp_auth - Configures a BGP Authentication Profile; panos_bgp_conditional_advertisement - Configures a BGP conditional advertisement Select a physical interface. Click OK. Create subinterface CLI. Layer 3 Subinterface; Log Card Interface; Log Card Subinterface; Decrypt Mirror Interface; Aggregate Ethernet (AE) Interface Group . Untagged subinterfaces are used in multi-tenant environments where each tenant's traffic must leave the firewall without VLAN tags. panos_aggregate_interface - configure aggregate network interfaces; panos_api_key - retrieve api_key for username/password combination; panos_bgp_aggregate - Configures a BGP Aggregation Prefix Policy; panos_bgp_auth - Configures a BGP Authentication Profile; panos_bgp_conditional_advertisement - Configures a BGP conditional advertisement According to the diagram, the port Gi0/2 will be the port trunking. The untagged L3 subinterfaces are designed to work without ip-address on the physical device. Web UI: CLI: # set network interface aggregate-ethernet <value> Aggregate interface name: ae1 - ae4 Set the aggregate ethernet interface type as layer2 or layer3: Web UI: CLI: # set network interface aggregate-ethernet ae1 + comment comment Navigate to the Network tab. Our internal user Internet traffic also traverses this firewall. Version 10.1; Version 10.0 (EoL) Version 9.1; Version 9.0 (EoL) . Creating subinterfaces The first step is to remove the IP configuration from the physical firewall. Aggregation of 10Gbps XFP and SFP+ is also supported. Steps Go to Network > Interfaces. Environment Alternatively, for the aggregate group, create a subinterface that uses DHCP to get its address. A Layer 3 aggregated link has been created between the Palo Alto Firewall (Interface ae1 on each firewall) and the Cisco 4507R+E Switch (Port-Channel 1 & 2). PAN supports sub-interfaces on aggregate interfaces. Palo Alto Networks Predefined Decryption Exclusions. We currently have a L3 interface on our core switch that is cabled to a L3 interface on each firewall which serves as the "inside" interface. Go to Network > Interface and click on Add Aggregate Group. Select Network Interfaces Ethernet , highlight the aggregate interface, such as ae1, and click Add Subinterface at the bottom of the screen. Open the interface configuration. Access to config mode and enter the command interface FastEthernet0/2 to enter this port. Network > Interfaces; Aggregate Ethernet (AE) Interface Group; Download PDF. Create Untagged subinterfaces and assign them a different virtual router and zone. For Interface Name , enter a number after the period, such as 107. Is there a way to create a sub-interface via CLI? Setting up a new physical interface can be cumbersome because you first have to get them cabled up and then you even need to be lucky enough to have an inter. Navigate to the IPv4 tab. Select the subnet. Set the Interface Type to Aggregate Ethernet . My environment has Palo Alto Firewalls that has Aggregate Interface configuration and use. PAN-OS 4.0 introduced a new form of layer 3 subinterface known as an untagged subinterface. Last Updated: Oct 23, 2022. Palo Alto calls it "Aggregate Interface Group" while Cisco calls it EtherChannel or Channel Group. 1. Enter the VLAN Tag to differentiate between the subinterfaces. Exclude a Server from Decryption for Technical Reasons. Select From the WebGUI, go to Network > Interfaces link. Aggregate Group: select ae1 just created. However, it is down on the Passive Firewall Passive Link State ( Under Device> High Availability> General > Active/Passive Settings) is enabled on both firewalls and members of the AE Interface are up on the Passive Firewall. 'ish. Go to Interfaces on the left pane. Configure the subinterface. In this video, we take a look at layer 3 subinterfaces on the Palo Alto Firewall.