Segment SD-WAN Traffic using VLAN Tags

1. Configure an SD-WAN interface profile for each ISP connection (subinterface) to define its link attributes.
2. Create a Layer 3 subinterface that uses a static IPv4 address.

   1. Select NetworkInterfacesEthernet and in the Template field select a template.
   2. Select an interface.
   3. For Interface Type, select Layer3 and click OK.
   4. Highlight the interface and click Add Subinterface at the bottom of the screen.
   5. After the Interface Name and period, enter the subinterface number.
   6. Enter a Tag for the subinterface (range is 1 to 4,094). For ease of use, make the tag the same number as the subinterface ID.
   7. On the IPv4 tab, Enable SD-WAN.
   8. Select the Type of address: Static.
   9. Add the IP address and subnet mask.
   10. Enter the IP address of the Next Hop Gateway.
   11. Click OK.

3. (SD-WAN plugin 3.2.0 and later versions) Create a Layer 3 subinterface that uses a static IPv6 address.

   1. Perform the first six substeps of the step to create a Layer 3 subinterface that uses a static IPv4 address, because they are the same for an IPv6 address.
   2. On the IPv6 tab, Enable IPv6 on the interface and Enable SD-WAN.
   3. In the EUI-64 (default 64-bit Extended Unique Identifier) field, enter the 64-bit EUI in hexadecimal format. If you leave this field blank, the firewall uses the EUI-64 generated from the MAC address of the physical interface. If you enable the Use interface ID as host portion option when adding an address, the firewall uses the Interface ID as the host portion of that address.
   4. Select the Type of address: Static.
   5. Select Address Assignment.

   6. Add an IPv6 Address for the interface or select New Variable to create the variable. SD-WAN supports one IPv6 address per physical interface.
   7. Enable address on interface.

   8. Use interface ID as host portion—.See the third substep above for explanation.
   9. Anycast—Select to make the IPv6 address (route) an Anycast address (route), which means multiple locations can advertise the same prefix, and IPv6 sends the anycast traffic to the node it considers the nearest, based on routing protocol costs and other factors.
   10. Next Hop Gateway—Enter the IPv6 address of the Next Hop Gateway (the next hop from the IPv6 address you entered). The Next Hop Gateway must be on the same subnet as the IPv6 address. The Next Hop Gateway is the IP address of the ISP’s default router that the ISP gave you when you bought the service. It is the next hop IP address to which the firewall sends traffic to reach the ISP’s network, and ultimately, the internet and the hub.
   11. Send Router Advertisement—Select to enable the firewall to send this address in Router Advertisements (RAs), in which case you must also enable the global Enable Router Advertisement option for the interface (on the Router Advertisement tab).
   12. Valid Lifetime (sec)—Enter the valid lifetime (in seconds) that the firewall considers the address valid. The valid lifetime must equal or exceed the Preferred Lifetime (sec) (default is 2,592,000).
   13. Preferred Lifetime (sec)—Enter the preferred lifetime (in seconds) that the valid address is preferred, which means the firewall can use it to send and receive traffic. After the preferred lifetime expires, the firewall can't use the address to establish new connections, but any existing connections are valid until the valid lifetime expires (default is 604,800).
   14. On-link—Select if systems that have addresses within the prefix are reachable without a router.
   15. Autonomous—Select if systems can independently create an IP address by combining the advertised prefix with an Interface ID.
   16. Click OK.
4. As an alternative to a static address, create a Layer 3 subinterface that uses DHCP to get its IPv4 address.

   1. Select NetworkInterfacesEthernet and in the Template field, select a template stack (not a template).
   2. Select an interface.
   3. For Interface Type, select Layer3 and click OK.
   4. Highlight the interface and click Add Subinterfaces at the bottom of the screen.
   5. Highlight the subinterface and click Override.
   6. Highlight the subinterface and after the Interface Name and period, enter the subinterface number.
   7. Enter a Tag for the subinterface (range is 1 to 4,094). For ease of use, make the tag the same number as the subinterface ID.
   8. On the IPv4 tab, Enable SD-WAN.
   9. Select Type of address: DHCP Client and Enable.
   10. Uncheck (do not select) Automatically create default route pointing to default gateway provided by server.
   11. Select the Advanced tab and then the DDNS tab.
   12. Select Settings and Enable. The Hostname is automatically generated by the Panorama SD-WAN plugin.
   13. Select the Vendor as Palo Alto Networks DDNS.
   14. Click OK.

5. Apply an SD-WAN Interface Profile to the subinterface.

   1. Highlight the subinterface you created and select the SD-WAN tab.
   2. Select the SD-WAN Interface Profile you created for this link or create a new profile.
   3. Click OK.
6. Repeat the prior steps to add more subinterfaces to the interface.
7. Commit.