Network > Interfaces > Tunnel
Use the following fields to configure a tunnel interface:
Tunnel Interface Settings
Interface Nameis set to
tunnel. In the adjacent field, enter a numeric suffix (1-9,999) to identify the interface.
Enter an optional description for the interface.
If you want to export unidirectional IP traffic that traverses an ingress interface to a NetFlow server, select the server profile or click
Netflow Profileto define a new profile (see Device > Server Profiles > NetFlow). Select
Noneto remove the current NetFlow server assignment from the interface.
If the firewall supports multiple virtual systems and that capability is enabled, select a virtual system (vsys) for the interface or click
Virtual Systemto define a new vsys.
Select a security zone for the interface, or click
Zoneto define a new zone. Select
Noneto remove the current zone assignment from the interface.
Management Profile—Select a profile that defines the protocols (for example, SSH, Telnet, and HTTP) you can use to manage the firewall over this interface. Select
Noneto remove the current profile assignment from the interface.
Enter the maximum transmission unit (MTU) in bytes for packets sent on this interface (576-9,192; default is 1,500). If machines on either side of the firewall perform Path MTU Discovery (PMTUD) and the interface receives a packet exceeding the MTU, the firewall returns an
ICMP fragmentation neededmessage to the source indicating the packet is too large.
For an IPv4 address
Add, then perform one of the following steps to specify a static IP address and network mask for the interface.
You can enter multiple IP addresses for the interface. The forwarding information base (FIB) your system uses determines the maximum number of IP addresses.
To delete an IP address, select the address and click
For an IPv6 address
Enable IPv6 on the interface
Select to enable IPv6 addressing on this interface.
Enter the 64-bit extended unique identifier (EUI-64) in hexadecimal format (for example, 00:26:08:FF:FE:DE:4E:29). If you leave this field blank, the firewall uses the EUI-64 generated from the MAC address of the physical interface. If you enable the
Use interface ID as host portionoption when adding an address, the firewall uses the interface ID as the host portion of that address.
Addand configure the following parameters for each IPv6 address: