topic Re: Setting up an IPSEC VPN Tunnel on AWS in VM-Series in the Public Cloud

Setting up an IPSEC VPN Tunnel on AWS

rockyyuan — Tue, 26 Feb 2019 19:08:15 GMT

Hi Palo Alto community,

I've been trying to follow this guide to set up a static IPSEC tunnel on AWS between two VPCs but having a bit of trouble:

https://knowledgebase.paloaltonetworks.com/servlet/fileField?entityId=ka10g000000D8OjAAK&field=Attachment_1__Body__s

This is my network diagram:

This is my configuration for the firewall in VPC A:

This is my configuration for the firewall in VPC B:

I had also added some firewall rules that weren't in the screenshots according to the guide but that didn't help turn the IPSEC tunnel status green either.

I also ran the command show vpn flow in the CLI but the state remains "init" on the tunnel:

Any suggestions would be appreciated, pretty new to using PA as I've been using mostly cisco/pfSense up to this point, thanks!

Re: Setting up an IPSEC VPN Tunnel on AWS

OtakarKlier — Tue, 26 Feb 2019 22:56:53 GMT

Hello,

Check the logs to see if the packets are getting from one pan to the other. If not it could be the AWS ACL firewall or your security groups are preventing the communication.

Hope that helps.

Re: Setting up an IPSEC VPN Tunnel on AWS

rockyyuan — Wed, 27 Feb 2019 18:10:33 GMT

So the support team resolved it.. it was due to the tunnel endpoint sitting on the same subnet as the private subnet on VPC 1.. apparently you need some subnet indicator on the 10.60.66.14 or it won't know where the gateway is, even if you hardcode the ARP. We solved the issue by making another subnet at 10.60.0.0/24 and used that for E1/1 in VPC 1.

I also needed to setup static routing config on the virtual router for E1/1.

Finally, we needed to run the following two commands to manually initiate the tunnel.

test vpn ike-sa gateway [ike gateway name]

test vpn ipsec-sa tunnel [tunnel name]