topic Re: How to Build IPsec connection without using Public IP at Branch Site in General Topics

How to Build IPsec connection without using Public IP at Branch Site

zlling — Mon, 06 Nov 2023 13:46:54 GMT

I want build IPsec connection bwtween HQ and Branch Office.

HQ using Public IP with fixed.

Branch Office using Internal IP with fixed. (have one ISP router above firewall)

May know the details setting?

and i need create port forward udp500,4500 on my ISP router?

Re: How to Build IPsec connection without using Public IP at Branch Site

Raido_Rattameister — Mon, 06 Nov 2023 15:18:27 GMT

Does Branch Site have static IP?

Do you have capability to configure port forwarding on ISP router?

Re: How to Build IPsec connection without using Public IP at Branch Site

zlling — Tue, 07 Nov 2023 00:44:55 GMT

Does Branch Site have static IP?

-Yes, branch office have static IP but with internal IP.

Do you have capability to configure port forwarding on ISP router?

-I have done configure port forward in my ISP router. (udp500,4500,4510,4511)

I'm new to PaloAlto, so I not sure the details setting in PaloAlto. I had see some discussion about the setting needed in IPsec when one of the site using an internal IP as wan IP. After trying the step mentioned, but failed. So may share to me the detail setting at both site? we need enable NAT-Traversal at both site? we need usingaggresive mode at both site? what need to configure in local & peer identification at both site?

Thank you.

Re: How to Build IPsec connection without using Public IP at Branch Site

Raido_Rattameister — Tue, 07 Nov 2023 01:48:50 GMT

You need to NAT only udp/500 and udp/4500.

On "Advanced Options" tab check "Enable NAT Traversal" checkbox and you are done.

You do not need aggressive mode.

Re: How to Build IPsec connection without using Public IP at Branch Site

zlling — Tue, 07 Nov 2023 03:13:43 GMT

Hi,

I had try this way. IPsec connection still failed to build.

Does IPsec function need license?

Thank you.

Re: How to Build IPsec connection without using Public IP at Branch Site

Raido_Rattameister — Tue, 07 Nov 2023 03:23:09 GMT

No license needed.

How do you identify that tunnel fails to build?

Do you see anything in system log?

If you enter command below and check System logs on other side what do you see?

test vpn ipsec-sa tunnel name-of-the-ipsec-tunnel