topic IPSEC Tunnel query in Next-Generation Firewall Discussions

IPSEC Tunnel query

Khanna075 — Mon, 26 Aug 2024 04:20:09 GMT

What is the use of Proxy ID in IPSEC tunnel configuration on Palo Alto ? When will it get negotiated and how ?

Re: IPSEC Tunnel query

SutareMayur — Mon, 26 Aug 2024 09:51:44 GMT

Proxy-ID in Palo Alto is nothing, but interesting traffic flowing through the tunnel. Palo Alto by default only supports ROUTE BASED VPN.

Now in any case when you form tunnel from Palo Alto to the PEER which is configured/acting as POLICY BASED VPN, Proxy-ID on Palo Alto side must be configured.

And the subnets configured in Proxy-ID and the ACL on the PEER side should match for successful negotiation. This will be evaluated during PHASE-2 negotiation.

If it is not matched/identical then PHASE-2 negotiation will not be successful, and you can review related logs under system logs by filtering ‘VPN’.

If both ends are acting as Route Based VPN, there is no need of defining proxy-ids.

If you defined proxy-id in this case also, anyways it is not going to be evaluated during PHASE-2 negotiation.

You can refer below Palo Alto provided ref articles.

Hope it helps!

Ref Article 1

Ref Article 2

Re: IPSEC Tunnel query

Khanna075 — Mon, 26 Aug 2024 09:54:01 GMT

Thank you for the explanation.
This makes sense to me now.

Re: IPSEC Tunnel query

SutareMayur — Mon, 26 Aug 2024 12:21:28 GMT

Hi @Khanna075 Glad to know that it helped you.

Could you please click Accept as Solution to acknowledge that the answer to your question has been provided ? This will help other readers also.

Thank you!

Re: IPSEC Tunnel query

Khanna075 — Mon, 26 Aug 2024 15:12:22 GMT

Yes, sure!

Re: IPSEC Tunnel query

Khanna075 — Mon, 26 Aug 2024 15:14:08 GMT

By the way I browsed to your youtube channel. Its looks good. Thank you for sharing it.