topic Where to add Proxy ID with multiple tunnels? in Next-Generation Firewall Discussions

Where to add Proxy ID with multiple tunnels?

rjdahav163 — Wed, 08 Feb 2023 23:33:03 GMT

Hey all,

We have 3 firewalls:

C1 = Cisco FW - Policy based S2S VPN -- subnet behind it 10.1.0.0/24

P2 = Palo FW - Route based S2S VPN -- subnet behind it 172.16.50.0/24

C3 = Cisco FW - Policy based S2S VPN -- subnet behind it 192.168.20.0/24

We have S2S tunnels as: C1 <---- tunnel.1---> P2 <-----tunnel.2-----> C3

Proxy ID on P2 are:

For tunnel.1 = local: 172.16.50.0/24, remote: 10.1.0.0/24

For tunnel.2 = local: 172.16.50.0/24, remote: 192.168.20.0/24

Routing is all static.

Now 10.1.0.50 wants to reach 192.168.20.79. There cannot be a direct tunnel between C1 and C3 and hence this needs to go through P2. This is currently now working. If I add the both the remote proxy ids to both the tunnels, then atleast 1 tunnel and sometimes both go down.

How can I get this working? Where and how do I add Proxy IDs?

Thanks!

Re: Where to add Proxy ID with multiple tunnels?

murali438 — Thu, 09 Feb 2023 04:32:00 GMT

For tunnel.1 you will have to use local PID # 192.168.20.0/24 , remote 10.1.0.0/24
For tunnel.2 you will have to use local PID # 10.1.0.0/24 , remote 192.168.20.0/24
remember to allow communication on your security policy from your VPN_ZONE to VPN_ZONE

Re: Where to add Proxy ID with multiple tunnels?

RusselMoos — Sun, 10 Nov 2024 18:15:15 GMT

Hello Everyone, what happens when you have more than one subnet on both sides?

Say I have Side A with 10.6.10.0/24 and 10.6.20.0/24 and on side B I have 10.1.10.0/24 and 10.1.20.0/24. Nothing overlaps, but please tell me what the proxy ID's would look like.

I just have a single tunnel created between them.

Re: Where to add Proxy ID with multiple tunnels?

CosminM — Sun, 10 Nov 2024 18:35:32 GMT

Hello @RusselMoos ,

Assuming that you need connectivity between all you distant subnet, then your Proxy-ID will have 4 rules, as follows for side A:

Re: Where to add Proxy ID with multiple tunnels?

RusselMoos — Sun, 10 Nov 2024 18:42:52 GMT

Thank you Cosmin! I will give that a try.