topic Re: Decommission IPSec site to site VPN in Next-Generation Firewall Discussions

Decommission IPSec site to site VPN

Mohamed18 — Fri, 27 Oct 2023 15:50:36 GMT

Hi All,

I have been looking at the best way to decommission VPN tunnels on Palo Alto firewall, and I could only find disabling the IKE phase1 and the IPSec tunnels. is there a recommended way to decom IPSec VPN tunnels on Palo Alto firewalls?

Thank you in advance.

Re: Decommission IPSec site to site VPN

Raido_Rattameister — Fri, 27 Oct 2023 18:03:59 GMT

If you want to decommission VPN then:

- Mark down tunnel interface number and zone tunnel is in Network > IPSec Tunnels, then delete the tunnel.
- Delete gateway from Network > Network Profiles > IKE Gateways
- Delete all static routes to tunnel interface identified in step 1 (Network > Virtual Routers)
- Delete tunnel interface itself Network > Interfaces > Tunnel

- Check if there are any NAT/Security policies related to zone where tunnel interface was in and if they are still needed.

If you don't want to delete but disable then both IKE Gateways (phase 1) and IPSec tunnels (phase 2) have disable option at the bottom of the page.

Re: Decommission IPSec site to site VPN

Mohamed18 — Mon, 30 Oct 2023 14:42:12 GMT

Thank you Raido