topic Re: VPN tunnel moving from Palto-ASA to Palto-Palto in General Topics

VPN tunnel moving from Palto-ASA to Palto-Palto

iguarino — Tue, 10 Sep 2013 19:40:53 GMT

I'm running PANOS 4.0.x and have a tunnel with a Cisco ASA peer. I had to create multiple IPSEC tunnels to work around the Proxy ID limitation of 10 per tunnel interface. This Cisco peer will be moving to a Palo Alto box running 5.0.x. If the far end Palto running 5.0.x just matches my Proxy ID's, then I should be good correct? And that 5.0.x Palto will not have to be configured with multiple tunnel interfaces, either. I recall reading somewhere that VPN tunnels between Palto's didn't need Proxy ID's defined. Just looking for clarification. Thank you.

Re: VPN tunnel moving from Palto-ASA to Palto-Palto

HULK — Tue, 10 Sep 2013 23:29:02 GMT

Hello Iguarino,

You are correct. PAN firewall will take 0.0.0.0/0 as proxy ID by default. So, if both ends are PAN firewall then need not to define the Proxy ID's.

FYI:-

1. Define a proxy ID on PAN firewall for more control over the traffic, define the traffic that needs to be Encrypted or the Interested traffic for an IPSEC tunnel.

2. This behavior is same for JUNIPER SRX firewall as well.

Hope this helps.

Thanks

Re: VPN tunnel moving from Palto-ASA to Palto-Palto

iguarino — Wed, 11 Sep 2013 13:02:18 GMT

Thanks HULK. So in this case, the 4.0 side will simply add destination routes to the proper tunnel interface (although limited to 10). The 5.0 side could add up to 250 destination routes pointing to its proper tunnel interface.

Re: VPN tunnel moving from Palto-ASA to Palto-Palto

HULK — Wed, 11 Sep 2013 18:27:07 GMT

Yes, you are correct.

Thanks