topic Re: ProxyID for Prisma Access Tunnels in Prisma Access Discussions

ProxyID for Prisma Access Tunnels

RamBalaji — Fri, 07 Feb 2020 07:29:38 GMT

Hi All,

I have doubt in adding proxyID in the VPN settings, the confusion is whether infra ip will be my local id/remote id (based on locations), I have attached prisma sample diagram. Can someone confirm local and remote ip for proxyid 1,2 for my understanding.

with regards,

Ram

Re: ProxyID for Prisma Access Tunnels

Sai_Tumuluri — Fri, 07 Feb 2020 13:20:09 GMT

Ram,

it's local/remote.

References:

Re: ProxyID for Prisma Access Tunnels

RamBalaji — Sat, 08 Feb 2020 17:36:11 GMT

Hi Sai,

I didn't get you.
From the diagram can you give me the local and remote ip address for proxy ID1 and proxy ID2.
I am confused because the actual communication is between 10.5.0.0 to 10.50.1.0. Infra subnet is in the middle and its primary purpose is to communicate resources in service connection.
So if you worked in prisma and can you give actual ip details for proxyids

with regards,

ram

Re: ProxyID for Prisma Access Tunnels

wprice — Wed, 12 Feb 2020 20:38:03 GMT

Hi Ram,

Thanks for your query! Are you speaking to the Tunnel Monitoring config using Proxy ID on Page 74 and 75 of the Prisma Access Panorama Admin guide?

https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-panorama-admin.pdf

The context here is around the Tunnel monitoring a Service Connection. This will probe the IP's specified to be sure traffic is not black-holed to a site that has gone down. For the Proxy ID config of your tunnel monitor traffic, The local subnet is your Infrastructure subnet since either the SC or RN when onboarded in our cloud will pull from this pool. The remote will the on-prem remote site subnet, etc..

If you are not using proxy IDs for tunnel monitoring you can just specify an IP that can be reached (can route to that remote IP) and is allowed (security policy allowed).

I hope this helps.

Wade

Re: ProxyID for Prisma Access Tunnels

Rob_Notman — Thu, 05 Mar 2020 15:05:03 GMT

Ram,

The proxy information you configure in Panorama for your tunnel is pushed to the cloud firewalls, so the local entry refers to the cloud firewall the remote entry refers to your on-prem device. Please keep in mind that if the on-prem device is also a PAN firewall you do not need to enable proxy-IDs since they are route-based firewalls.