topic Re: SD WAN using loopback on Palo Alto in General Topics

SD WAN using loopback on Palo Alto

mmercald — Mon, 16 Sep 2024 15:41:57 GMT

I configuring a HUB for SDWAN with vpn, however this firewall currently have vpn tunnels to 3rd parties. Due to this I am planning on using a separate wan ip for sd-wan. However I do not have free ports on my firewall for this. Is it possible to configure a SDWAN HUB to use a natted loopback? If so I am not seeing any place to configure teh sd-wan interface profile for the loopback

Re: SD WAN using loopback on Palo Alto

delliott_6784 — Mon, 16 Sep 2024 17:07:30 GMT

In my similar situation, I used an untagged sub-interface to terminate non-SDWAN tunnel connections.

Re: SD WAN using loopback on Palo Alto

mmercald — Mon, 16 Sep 2024 17:15:55 GMT

wouldnt this cause a conflict? if the parent interface has an ip of 1.1.1.1/24 and the sub interface has an ip of 1.1.1.2/24 wouldnt that cause an issue?

Re: SD WAN using loopback on Palo Alto

mmercald — Wed, 18 Sep 2024 00:57:51 GMT

I tried doing this but I am getting an ARP issue, can you please go into detail regarding this setup?

Re: SD WAN using loopback on Palo Alto

sridic — Thu, 26 Sep 2024 14:42:22 GMT

Capability to use multiple IPs on SD-WAN participating interfaces was introduced with 11.1.0+ and plugin 3.2, so make sure you use those versions as minimum. Also, SD-WAN terminating IP will need to be first added then all additional IPs that you will have up to 4.
You can't terminate SD-WAN on a loopback currently, only on Physical Ethernet, AE, or Ethernet or AE subinterface.