topic Re: IP Sec VPN Paloalto - Starlink in General Topics

IP Sec VPN Paloalto - Starlink

CraigSmith2 — Mon, 27 Mar 2023 16:16:46 GMT

I'm testing Starlink business and having issues passing traffic over my tunnel. This remote site connects to our data center via an IPsec tunnel. I can get the tunnel up and traceroute to the remote side of the tunnel, but I'm unable to pass traffic. I have "Enable NAT Traversal" selected on my IKE Gateway. The Starlink is set to IP passthrough.

Any help would be appreciated.

Re: IP Sec VPN Paloalto - Starlink

Raido_Rattameister — Mon, 27 Mar 2023 18:23:39 GMT

If you can traceroute to other side over the tunnel it means that some traffic does cross the tunnel successfully right?

Re: IP Sec VPN Paloalto - Starlink

CraigSmith2 — Tue, 28 Mar 2023 20:33:09 GMT

Yes, I agree, however, I'm unable to ping the management interface of the PA-220. Also from the remote side, I can't ping the gateway that is on the PA-220 for any of my vlans and my Cisco phones do not register.

Re: IP Sec VPN Paloalto - Starlink

Raido_Rattameister — Wed, 29 Mar 2023 00:59:20 GMT

Both sides have Palo?

Do you have access to firewalls on both side?

Re: IP Sec VPN Paloalto - Starlink

CraigSmith2 — Wed, 29 Mar 2023 15:31:14 GMT

Yes, both sides have Palo Altos. When I'm on-site I have access to both firewalls. I have to unplug the Starlink cable to keep my other tunnel running.

Re: IP Sec VPN Paloalto - Starlink

Raido_Rattameister — Wed, 29 Mar 2023 15:48:33 GMT

Check firewall policies on both sides if they permit traffic to/from tunnel zone.

Can you share screenshot of working and not working traffic log from both sides and have at least those columns visible.

Re: IP Sec VPN Paloalto - Starlink

CraigSmith2 — Tue, 04 Apr 2023 16:30:04 GMT

Thank you for your response. Both sides have policies that permit traffic to/from the tunnel zone. I have another circuit that works with no issues at this site. However, when getting the screenshots you requested I noticed that on Starlink most of the traffic goes Interzone-default policy and is denied.

Re: IP Sec VPN Paloalto - Starlink

OtakarKlier — Tue, 04 Apr 2023 21:37:41 GMT

Hello,

Do you have policies in place to allow the traffic to flow via the tunnel? Also how is the 'default', 0.0.0.0/0 route getting advertised on the 'remote' side, or is it a static route?

Regards,

Re: IP Sec VPN Paloalto - Starlink

OtakarKlier — Tue, 04 Apr 2023 21:39:45 GMT

Hello,

Sorry I didnt see the traffic screen shots before. But it looks like there are missing policies so the traffic is hitting the 'default' policies.

Regards,

Re: IP Sec VPN Paloalto - Starlink

ChrisThornton — Sat, 06 Jan 2024 23:35:54 GMT

I'm having the same problem. It dosn't happen all the time. I think it has to do with esp traffic being blocked

Re: IP Sec VPN Paloalto - Starlink

Pollack32 — Tue, 09 Jan 2024 07:05:20 GMT

Is there any solution.?

Re: IP Sec VPN Paloalto - Starlink

OtakarKlier — Mon, 08 Jan 2024 15:36:47 GMT

Hello,

For the policy that handles the VPN traffic, do not perform and inspections or ssl decryption, etc. Basically allow all traffic to/from the two IP's that are the VPN endpoints and see how that works out. My guess is that there is UDP traffic getting blocked/dropped.

Regards,

Re: IP Sec VPN Paloalto - Starlink

CraigSmith2 — Fri, 23 Aug 2024 17:50:01 GMT

Sorry for not responding. I abandoned this project.

Yes the routes are static and looking back at my screenshots I think you are correct that policies were missing.

I'm considering trying StarLink again, I was reviewing what went wrong. Thank you for your help.

Re: IP Sec VPN Paloalto - Starlink

dkaliel — Fri, 18 Oct 2024 15:24:44 GMT

We had the same issue and StarLink confirmed the following so we are looking into a solution

ESP packets are dropped.

VPNs that rely on protocols 47 (GRE), 50 (ESP), 51 (AH), 115 (L2TP) are dropped by CGNAT at this time.

Re: IP Sec VPN Paloalto - Starlink

PktBlocker — Sat, 29 Mar 2025 01:50:46 GMT

Just going to chime in for folks like myself who have limited choices. I found a good article on a competitor site that helped me and i managed to get a site to site up thru starlink residential.

my setup is PA-->FTG-->Starlink--->ISP--->PA Corp.

PA on Corp side is in passive mode since it has the static ip

Both PAs are running ikev1 in aggressive mode with NAT-T

The FTG in my case is just acting like a service provider

https://community.fortinet.com/t5/Support-Forum/IPSEC-tunnels-behind-CGNAT-Starlink/m-p/226976

https://www.starlink.com/support/article/aa5aecf3-e97c-e84e-3f87-8d2ecdfde857

I am a bit curious if anyone has run any testing to see if any of the ports are blocked per the article from starlink below? I would think the traffic thru the vpn would be immune to this.

https://www.starlink.com/support/article/c3caacdf-1c1f-98db-b821-bbb36ca9d89b