topic Route to IPSec Tunnel in General Topics

Route to IPSec Tunnel

Sanjay_Ramaiah — Mon, 17 Jul 2023 10:57:34 GMT

Hi All,

I need to add a route pointing to a Tunnel interface. As the peer has dynamic IP have created the IPsec tunnel with Dynamic IP Peer Identification as its Hostname.

To Add route in the VR as we do not have IP address if i just point it to the tunnel interface and select IP address as none would be enough?

Or is there any other way to configure it?

Regards,

Sanjay S

Re: Route to IPSec Tunnel

seb_rupik — Mon, 17 Jul 2023 15:24:43 GMT

Hi there,

To add a static route you would specify the tunnel next-hop along with the destination prefix. For the purpose of routing via the tunnel you do not worry about the remote end having a dynamic address, it is the encapsulated address that you are interested in and this will be static.

IP address, next-vr and FQDN are valid values for the mandatory next-hop field. Specifying the outbound interface is optional. It is worth noting that creating a static route without a next-hop address comes with the addtional baggage of increasing the ARP table. At least that is the case on other routing platforms, thankfully Palo Alto doesn't let you! I wrote a blog post about it if you are interested:

Static route next-hop – CS7 Networks

cheers,

Seb.

Re: Route to IPSec Tunnel

OtakarKlier — Mon, 17 Jul 2023 21:41:46 GMT

Hello,

When entering the static route, Enter the following:

Name: <whatever name you choose>

Destination: <Your ip/subnet in CIDR>

Interface: <Your tunnel interface>

Next Hope: NONE

Hopefully there is a corresponding route on the other side to get traffic back.

Regards,