topic Re: 2 Palo Alto VM-Serie for IPsec VPN in VM-Series in the Public Cloud

2 Palo Alto VM-Serie for IPsec VPN

jeromecarrier — Tue, 29 Nov 2022 21:35:39 GMT

Hello

We deploy 2 VM-Series on Azure as recommanded by PA. These 2 FW manage Inbound/Outbound traffic and between our internals zones. A public load balancer have been configured. We need to connect our Azure infrastructure with our local datacenter via IPsec VPN between PA on Azure and firewall on our datacenter.

Do you know if it's possible to configure an IPsec tunnel between our FW in datacenter and our 2 VM-Serie on Azure to avoid lost communication between Azure and datacenter when one of PA reboots?

Regards

Jérôme

Re: 2 Palo Alto VM-Serie for IPsec VPN

SutareMayur — Wed, 30 Nov 2022 12:24:40 GMT

@jeromecarrier I do not see any issues on configuring the IPSEC tunnel between your DC and Azure PAs as at the end, it will be tunnel between your DC and the Palo Alto only. You just need to make sure about the reachability between the peers and the routing for the encryption domain.

In regard to your 2nd query, how are the both Palo Altos configured ? Are those in HA or Individual firewalls ?

Re: 2 Palo Alto VM-Serie for IPsec VPN

jeromecarrier — Sat, 03 Dec 2022 12:59:07 GMT

It's 2 individual firewall with azure LB in Frontend for inbound trafic to our internal Web servers.

But for VPN Ipsec HA, I don't see how to configure my 2 FW to keep the communication between our servers in Azure and our local site when I have one FW unavailable...

Re: 2 Palo Alto VM-Serie for IPsec VPN

aleksandar.astardzhiev — Sat, 03 Dec 2022 17:43:39 GMT

Hi @jeromecarrier ,

Any particular reason you want to use the PA FWs in Azure as IPsec peers?

I would suggest you to use Azure native components - Azure VPN gateway. It is more simple and convenient instead of wondering how to handle firewall failover.

Depending on your Azure setup you may decide to pass this traffic over Azure PA FW, or not.