topic Re: can setup site-to-site ipsec vpn if palo alto firewall sits behind a router (NAT)? in Integration Discussions

can setup site-to-site ipsec vpn if palo alto firewall sits behind a router (NAT)?

jiakeai1999 — Mon, 24 Jan 2022 22:52:36 GMT

Hi, If palo alto sits behind a router (NAT) and palo alto external IP is a private IP (192.168.x.x), can setup a site-to-site IPsec VPN/GRE tunnel with remote site router (public external IP)? please advise, thanks in advance.

Re: can setup site-to-site ipsec vpn if palo alto firewall sits behind a router (NAT)?

ManojV5 — Fri, 25 Nov 2022 03:30:47 GMT

Hi - Have you done this setup, I need help. If you have implemented could you please share the steps?

Re: can setup site-to-site ipsec vpn if palo alto firewall sits behind a router (NAT)?

PavelK — Fri, 25 Nov 2022 21:58:26 GMT

Hello @ManojV5

thanks for posting in LIVEcommunity!

I have one site where due to circuit/ISP limitation, PA Firewall is sitting behind a device doing NAT. The PA has on its untrust interface assigned IP address in 192.168.X.X range. This scenario is functional to build an IPsec tunnel as long as NAT device in between can do a bidirectional NAT. There is a KB describing this scenario: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClopCAC

Kind Regards

Pavel

Re: can setup site-to-site ipsec vpn if palo alto firewall sits behind a router (NAT)?

aleksandar.astardzhiev — Sun, 27 Nov 2022 13:40:03 GMT

Hi @jiakeai1999 , @ManojV5 ,

As part of IPsec phase1 negotiation both peers are using identifications (ID). By default peer IP (local and remote) is used if no explicit ID is used. So configuring tunnel with peer behind NAT is pretty much the same as normal IPSec with to critical components that are mandatory for NAT to work:

- Enable NAT-T (nat traversal) to allow ESP encapsulation in UDP - ESP cannot be NATed, so NAT-T encapsulate ESP in UDP so it can be forwarded over NAT device. This must be enable on peers

- Use FW IP (the one assigned on fw interface) as Identification. On the FW behind the NAT, you need to set local id as type IP and put the private IP. For the other peer you need to set remote ID as type IP and put the private IP for the fw behind the nat.