Configure an Aggregate Ethernet Interface and Subinterfaces for SD-WAN
Table of Contents
3.2 & Later
Expand all | Collapse all
-
- Create a Link Tag
- Configure an SD-WAN Interface Profile
- Configure a Physical Ethernet Interface for SD-WAN
- Configure an Aggregate Ethernet Interface and Subinterfaces for SD-WAN
- Configure Layer 3 Subinterfaces for SD-WAN
- Configure a Virtual SD-WAN Interface
- Create a Default Route to the SD-WAN Interface
-
- Create a Path Quality Profile
-
- Create a SaaS Quality Profile
- Use Case: Configure SaaS Monitoring for a Branch Firewall
- Use Case: Configure a Hub Firewall Failover for SaaS Monitoring from a Branch Firewall to the Same SaaS Application Destination
- Use Case: Configure a Hub Firewall Failover for SaaS Monitoring from a Branch Firewall to a Different SaaS Application Destination
- SD-WAN Traffic Distribution Profiles
- Create a Traffic Distribution Profile
- Create an Error Correction Profile
- Configure an SD-WAN Policy Rule
- Allow Direct Internet Access Traffic Failover to MPLS Link
- Configure DIA AnyPath
- Distribute Unmatched Sessions
- Configure Multiple Virtual Routers on SD-WAN Hub
- Configure Multiple Virtual Routers on SD-WAN Branch
- Configure HA Devices for SD-WAN
- Create a VPN Cluster
- Create a Full Mesh VPN Cluster with DDNS Service
- Create a Static Route for SD-WAN
- Configure Advanced Routing for SD-WAN
Configure an Aggregate Ethernet Interface and Subinterfaces
for SD-WAN
SD-WAN supports AE interfaces for link redundancy and
tagged Layer 3 subinterfaces for traffic segmentation.
Physical firewalls running PAN-OS 11.0 and
SD-WAN Plugin 2.1.0 support SD-WAN on aggregated Ethernet (AE) interfaces
so that an SD-WAN firewall in a data center, for example, can have
an aggregate interface group (bundle) of physical Ethernet interfaces
that provide link redundancy. SD-WAN supports AE interfaces with
or without subinterfaces. You can create an AE interface with subinterfaces
that you can tag for different ISP services in order to provide
end-to-end traffic segmentation. Thus, your ISP services can reach
multiple labs or buildings without needing a dedicated pair of fibers
for each connection. A Layer 3 AE interface group connects to a
router, as shown in the following figure:
![](/content/dam/techdocs/en_US/dita/_graphics/11-1/sd-wan/sd-wan-ae-sub-topology.png)
VM-Series
firewalls do not support AE interfaces. An SD-WAN hub or branch
firewall that has an AE interface should not belong to the same
VPN cluster as a VM-Series SD-WAN hub or branch firewall because
AE interfaces are not supported on VM-Series firewalls.
PPPoE
is not supported on subinterfaces.
- Configure an SD-WAN Interface Profile for each ISP connection (subinterface) in the AE interface group to define its link attributes.
- Create an AE interface group.
- Select, select a PanoramaNetworkInterfacesEthernetTemplate, andAdd Aggregate Group.
- ForInterface Name, enter the number to identify the aggregate group; range is 1 to 16.
- ForInterface Type, selectLayer3.
- ClickOK.
- Assign physical interfaces to the aggregate group.
- Selectand select the interface you want to assign to the aggregate group.NetworkInterfacesEthernet
- Select theInterface TypeasAggregate Ethernet.
- Select theAggregate Groupyou created; for example, ae1.
- On theAdvancedtab, select theLink Speed,Link Duplex, andLink State.
- ClickOK.
- Repeat this step for each interface you want to assign to the aggregate group.
- For the aggregate group, create a subinterface that uses a static IP address.
- Select, highlight the aggregate interface, such as ae1, and clickNetworkInterfacesEthernetAdd Subinterfaceat the bottom of the screen.
- ForInterface Name, enter a number after the period, such as 107.
- Enter the VLANTagto differentiate between the subinterfaces. For ease of use, make the tag the same number as the subinterface ID.
- To configure a static IPv4 address for the subinterface, select theIPv4tab andEnable SD-WAN.
- Select theTypeof address:Static.
- AddtheIPaddress (and subnet mask) of the subinterface.
- Enter the IP address of theNext Hop Gateway.
- To configure a static IPv6 address for the subinterface, select theIPv6tab,Enable IPv6 on the interface, andEnable SD-WAN.
- In theEUI-64 (default 64-bit Extended Unique Identifier)field, enter the 64-bit EUI in hexadecimal format. If you leave this field blank, the firewall uses the EUI-64 generated from the MAC address of the physical interface. If you enable theUse interface ID as host portionoption when added an address, the firewall uses the Interface ID as the host portion of that address.
- SelectAddress AssignmentandAddan IPv6Addressfor the interface or selectNew Variableto create the variable.
- Use interface ID as host portion; see prior substep forEUI-64.
- SelectAnycastto make the IPv6 address (route) an Anycast address (route), which means multiple locations can advertise the same prefix, and IPv6 sends the anycast traffic to the node it considers the nearest, based on routing protocol costs and other factors.
- Enter the IPv6 address of theNext Hop Gateway(the next hop from the IPv6 address you entered). The Next Hop Gateway must be on the same subnet as the IPv6 address. The Next Hop Gateway is the IP address of the ISP's default router that the ISP gave you when you bought the service. It is the next hop IP address to which the firewall sends traffic to reach the ISP's network, and ultimately, the internet and the hub.
- SelectSend Router Advertisementto enable the firewall to send this address in Router Advertisements (RAs), in which case you must also enable the globalEnable Router Advertisementoption for the interface (on the Router Advertisement tab).
- Enter theValid Lifetime (sec)in seconds that the firewall considers the address valid. The valid lifetime must equal or exceed thePreferred Lifetime (sec)(default is 2,592,000).
- Enter thePreferred Lifetime (sec)(in seconds) that the valid address is preferred, which means the firewall can use it to send and receive traffic. After the preferred lifetime expires, the firewall can't use the address to establish new connections, but any existing connections are valid until the valid lifetime expires (default is 604,800).
- SelectOn-linkif systems that have addresses within the prefix are reachable without a router.
- SelectAutonomousif systems can independently create an IP address by combining the advertised prefix with the Interface ID.
- ClickOK.
- As an alternative to a static address, for the aggregate group, create a subinterface that uses DHCP to get its address.
- Selectand in theNetworkInterfacesEthernetTemplatefield, select a Template Stack.
- Highlight the aggregate interface, such as ae1, and clickAdd Subinterfaceat the bottom of the screen.
- Highlight the subinterface and clickOverrideat the bottom of the screen.
- Highlight the subinterface and forInterface Name, enter a number after the period, such as 1.
- Enter the VLANTagto differentiate between the subinterfaces. For ease of use, make the tag the same number as the subinterface ID.
- Select theIPv4tab andEnable SD-WAN.A subinterface in an aggregated interface group supports only an IPv4 address as a DHCP client, not an IPv6 address.
- Select theTypeof address:DHCP Client.
- SelectEnable.
- Uncheck (do not select)Automatically create default route pointing to default gateway provided by server.
- Select theAdvancedtab andDDNStab.
- SelectSettingsandEnable. TheHostnameis automatically generated by the Panorama SD-WAN plugin.
- Select theVendorasPalo Alto Networks DDNS.
- ClickOK.
- Apply an SD-WAN Interface Profile to the subinterface.
- Highlight the subinterface you created and select theSD-WANtab.
- Select theSD-WAN Interface Profileyou created for this link or create a new profile.
- ClickOK.
- Repeat the prior steps to create additional Layer3 subinterfaces for the aggregate interface group and apply an SD-WAN Interface Profile to each subinterface.
- Commit.