Next-Generation Firewall
Configure a Tunnel Interface
Table of Contents
Configure a Tunnel Interface
Configure a tunnel interface to connect to and establish
a VPN tunnel.
Contact your account team to enable Cloud Management for NGFWs using
Strata Cloud Manager.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
One of these:
|
To set up a VPN tunnel, the Layer 3 interface at each end must have a logical tunnel interface
for the firewall to connect to and establish a VPN tunnel. A tunnel interface is a
logical (virtual) interface that is used to deliver traffic between two endpoints.
If you configure any Proxy IDs, the Proxy ID is counted toward any IPSec tunnel
capacity.
The tunnel interface must belong to a security zone to apply a policy rule and it must be
assigned to a logical router in order to use the existing routing infrastructure.
Ensure that the tunnel interface and the physical interface are assigned to the same
logical router so that the firewall can perform a route lookup and determine the
appropriate tunnel to use.
- Log in to Strata Cloud Manager.Select .Select a firewall from your Folders or select Snippets to configure the tunnel interface in a snippet.If you select a folder or select a snippet, you create a tunnel interface variable that must be assigned at the device level.Add Tunnel.Enter the Interface Name.By default, all tunnel interfaces are prefixed with tunnel. The tunnel interface name supports numeric characters only.(Optional) Enter a Description.(Folders and Snippets only; Optional) Assign the interface to a Logical Router.See Configure a Logical Router for more information.Selecting a global router will prompt a message asking if you want to override and remove the inherited objects. Click Yes to confirm.(Folders and Snippets only; Optional) Assign the interface to a Zone.Create New to create a new zone. See Zone Protection and DoS Protection for more information.Selecting an inherited zone overrides the previous settings and removes any inherited objects. Any changes made to the global folder are no longer inherited in a top-down manner. A message appears, indicating that the interface settings will be overridden and the inherited objects from the parent folder will be removed on all firewalls. When you save your changes, a confirmation message appears. If you confirm, the zone is overridden.Add static IP addresses to configure the interface IPv4 settings.Only Static IP addresses are supported.To route traffic between the sites, a tunnel interface doesn’t require an IP address. An IP address is only required if you want to enable tunnel monitoring or if you’re using a dynamic routing protocol to route traffic across the tunnel. With dynamic routing, the tunnel IP address serves as the next hop IP address for routing traffic to the VPN tunnel.Save.Push Config to push your configuration changes.
