topic Re: Tunnel inside of Tunnel in Next-Generation Firewall Discussions

Tunnel inside of Tunnel

skey4867 — Fri, 28 Mar 2025 22:38:54 GMT

I have a site to site configure and tunnel established between palo alto and juniper vsrx. I am trying to route an IPSec tunnel through the existing tunnel. I am able to ping through the existing tunnels so connectivity exist. I have applied and "ANY/ANY" policy as well. The issue I is the traffic from the "spoke/remote" is able to send the IKEv2 Initiation through the tunnel but the Hub response is never making it back. I see the session in the browser as being sent to the hub but again the return traffic is lost somewhere. If I connect Palo Alto to Palo Alto the inner tunnel establishes just fine through the outter tunnel. If I configure Juniper to Juniper same outcome. No ACL's or anything like that that are applied either.

Re: Tunnel inside of Tunnel

ozheng — Wed, 02 Apr 2025 04:06:36 GMT

Hello @skey4867 ,

@skey4867 wrote:

I have a site to site configure and tunnel established between palo alto and juniper vsrx. I am trying to route an IPSec tunnel through the existing tunnel. I am able to ping through the existing tunnels so connectivity exist. I have applied and "ANY/ANY" policy as well. The issue I is the traffic from the "spoke/remote" is able to send the IKEv2 Initiation through the tunnel but the Hub response is never making it back. I see the session in the browser as being sent to the hub but again the return traffic is lost somewhere. If I connect Palo Alto to Palo Alto the inner tunnel establishes just fine through the outter tunnel. If I configure Juniper to Juniper same outcome. No ACL's or anything like that that are applied either.

Are you trying to do some tunnel in a tunnel?

Also, you can refer to https://live.paloaltonetworks.com/t5/pancast-episodes/pancast-episode-12-troubleshooting-ipsec-tunnels/ta-p/532287 for some initial troubleshooting.

Olivier

Re: Tunnel inside of Tunnel

skey4867 — Mon, 07 Apr 2025 17:12:00 GMT

Hello Olivier,

Thanks for you reply. Yes I am trying to establish an IPSec tunnel inside and already established IPSec Tunnel. I have attached an example diagram to hopefully outline what I am trying to achieve.