Proxy IDs between Peers

AY_FASAR — Thu, 20 Mar 2025 14:19:37 GMT

Hi,

if the remote peer require local palo alto to set proxy IDs, what happens if the proxy IDs at PAN side doesn't match the ones at remote? would this cause any issue i.e traffic gets dropped or does palo alto forward the traffic down the tunnel as long as there is a route.

Thanks

Re: Proxy IDs between Peers

ozheng — Mon, 24 Mar 2025 04:56:55 GMT

Hello @AY_FASAR ,

Not sure there is something you can predict, it depends on each vendor implementation.

In case of mismatch, the device can for instance apply the stricter proxy ID (if there is an overlap - ie 0.0.0.0/0 <> 0.0.0.0/0 // 1.1.1.1/32 <>2.2.2.2/32)

It may also simply block the tunnel from coming up.

Best practice: make all the info matching on both sides.

It makes understanding of the architecture / troubleshooting way simpler.

PanCast

https://live.paloaltonetworks.com/t5/pancast-episodes/pancast-episode-12-troubleshooting-ipsec-tunnels/ta-p/532287

Olivier

topic Re: Proxy IDs between Peers in Next-Generation Firewall Discussions

Proxy IDs between Peers

Re: Proxy IDs between Peers