GRE Tunnel Configuration on Paloalto Firewall

 Network Topology:

 

Configuration:

   devices {
    localhost.localdomain {
      network {
        interface {
          ethernet {
            ethernet1/1 {
              layer3 {
                ipv6 {
                  neighbor-discovery {
                    router-advertisement {
                      enable no;
                    }
                  }
                }
                ndp-proxy {
                  enabled no;
                }
                interface-management-profile mgmt;
                lldp {
                  enable no;
                }
                ip {
                  192.168.0.111/24;
                }
              }
            }
          }
          loopback {
            adjust-tcp-mss {
              enable no;
            }
            ip {
              11.11.11.111/32;
            }
            interface-management-profile mgmt;
          }
          tunnel {
            units;
          }
        }
        profiles {
          monitor-profile {
            default {
              interval 3;
              threshold 5;
              action wait-recover;
            }
          }
          interface-management-profile {
            mgmt {
              http yes;
              https yes;
              ssh yes;
              snmp yes;
              ping yes;
              telnet yes;
            }
          }
        }

        virtual-router {
          default {
            protocol {
              bgp {
                enable no;
                dampening-profile {
                  default {
                    cutoff 1.25;
                    reuse 0.5;
                    max-hold-time 900;
                    decay-half-life-reachable 300;
                    decay-half-life-unreachable 900;
                    enable yes;
                  }
                }
                routing-options {
                  graceful-restart {
                    enable yes;
                  }
                }
              }
              rip {
                enable no;
              }
              ospf {
                enable no;
              }
              ospfv3 {
                enable no;
              }
            }
            interface [ ethernet1/1 loopback tunnel];
            ecmp {
              algorithm {
                ip-modulo;
              }
            }
            routing-table {
              ip {
                static-route {
                  GRE {
                    path-monitor {
                      enable no;
                      failure-condition any;
                      hold-time 2;
                    }
                    bfd {
                      profile None;
                    }
                    interface tunnel;
                    metric 10;
                    destination 11.11.11.108/32;
                    route-table {
                      unicast;
                    }
                  }
                }
              }
            }
          }
        }
        tunnel {
          gre {
            GRE-TUN {
              local-address {
                ip 192.168.0.111/24;
                interface ethernet1/1;
              }
              peer-address {
                ip 192.168.0.108;
              }
              keep-alive {
                enable no;
              }
              tunnel-interface tunnel;
            }
          }
        }
      }

 security {
              rules {
                GRE-untrust 513b6a5b-3d6b-42f6-8f71-6e41f7c07e02 {
                  to trust;
                  from untrust;
                  source any;
                  destination any;
                  source-user any;
                  category any;
                  application any;
                  service application-default;
                  hip-profiles any;
                  action allow;
                }
                GRE-Trust deb07aba-1e21-4c3d-bbf6-3ca808144208 {
                  to trust;
                  from trust;
                  source any;
                  destination any;
                  source-user any;
                  category any;
                  application any;
                  service application-default;
                  hip-profiles any;
                  action allow;
                }
              }
            }
            default-security-rules {
              rules {
                intrazone-default 73b32d6c-e60a-48b3-b5d1-8e6bcd3bfbbf {
                  action deny;
                  log-start no;
                  log-end no;
                }
              }
            }
          }
 security {
              rules {
                GRE-untrust 513b6a5b-3d6b-42f6-8f71-6e41f7c07e02 {
                  to trust;
                  from untrust;
                  source any;
                  destination any;
                  source-user any;
                  category any;
                  application any;
                  service application-default;
                  hip-profiles any;
                  action allow;
                }
                GRE-Trust deb07aba-1e21-4c3d-bbf6-3ca808144208 {
                  to trust;
                  from trust;
                  source any;
                  destination any;
                  source-user any;
                  category any;
                  application any;
                  service application-default;
                  hip-profiles any;
                  action allow;
                }
              }
            }
            default-security-rules {
              rules {
                intrazone-default 73b32d6c-e60a-48b3-b5d1-8e6bcd3bfbbf {
                  action deny;
                  log-start no;
                  log-end no;
                }
              }
            }
          }