topic Configuring S2S VPN for Paloalto Deployed in Active/passive azure by using External LB IP in VM-Series in the Public Cloud

Configuring S2S VPN for Paloalto Deployed in Active/passive azure by using External LB IP

yassirjimie — Wed, 29 Apr 2020 08:08:45 GMT

I have deployed Paloalto in HA A/P in Azure i need to establish S2S VPN to Onprem but i dont want to use floating IP because the failover time is very long in production environment ,

can I use External Load Blanacer PIP and Create Load Balancing Rule (UDP 500 , 4500) to establish this VPN instead of floating IP .

Re: Configuring S2S VPN for Paloalto Deployed in Active/passive azure by using External LB IP

jmeurer — Wed, 29 Apr 2020 12:20:01 GMT

The load balancer is typically not an option for VPN termination b/c there is no persistence as the port moves through phases of negotiation. I typically recommend that you terminate the VPN on the Azure VGW and use our reference architecture method of routing through the firewalls from the gateway subnet. More information can be found here.

https://www.paloaltonetworks.com/resources/reference-architectures/azure