topic Re: About Service Connection with AWS in Prisma Access Discussions

About Service Connection with AWS

sujichoi — Tue, 07 Jan 2025 01:41:45 GMT

hello

I am using AWS by connecting to service connection. (using prisma cloud)

Is there anyone who runs both primary and secondary tunnel connecting AWS?

In my case, bgp neighbor setup was not possible due to the 169.254.0.0/16 band.

It was running statically, but the secondary tunnel was not live, so even if I ran a tunnel monitor, the 169.254.0.0/16 band overlapped, so tunnel monitoring did not turn on, making communication impossible.

Are you also only using one primary tunnel when connecting to AWS?

Re: About Service Connection with AWS

Vickynet — Tue, 07 Jan 2025 03:16:05 GMT

@sujichoi wrote:

hello

I am using AWS by connecting to service connection. (using prisma cloud)

Is there anyone who runs both primary and secondary tunnel connecting AWS?

In my case, bgp neighbor setup was not possible due to the 169.254.0.0/16 band.

It was running statically, but the secondary tunnel was not live, so even if I ran a tunnel monitor, the 169.254.0.0/16 band overlapped, so tunnel monitoring did not turn on, making communication impossible.

Are you also only using one primary tunnel when connecting to AWS?

Hello @sujichoi , check these two links out, I think it may address your questions:

Tunnel options for your AWS Site-to-Site VPN connection: https://docs.aws.amazon.com/vpn/latest/s2svpn/VPNTunnels.html

Onboard an AWS Virtual Private Cloud: https://docs.paloaltonetworks.com/prisma-access/integration/secure-public-cloud-deployment-with-prisma-access/onboard-an-aws-virtual-private-cloud

Thank you,

Vickynet

Re: About Service Connection with AWS

sujichoi — Tue, 07 Jan 2025 04:38:47 GMT

thanks for reply.

but aws tunnel is only change in 169.254.0.0/16. this subnet is using strata cloud too.