topic Re: IPsec to Azure with a DHCP WAN IP + SDWAN + GlobalProtect in General Topics

IPsec to Azure with a DHCP WAN IP + SDWAN + GlobalProtect

skullbox15 — Wed, 18 Sep 2024 18:46:55 GMT

I tried to go down this rabbit hole once with no success. The IPsec tunnel to Azure should be fairly easy, it's what I already have configured that complicates it...

I currently have a PA-220 with (2) WAN connections [both DHCP] and currently using SD-WAN. Currently running PANOS- 10.1.8

I have a GlobalProtect portal/gateway running on 1 of the WAN links and had to use a loopback interface since my connection is DHCP from the provider.

What would be my best course of action to get this working? Can I run 2 different loopbacks in the WAN zone?

Re: IPsec to Azure with a DHCP WAN IP + SDWAN + GlobalProtect

OtakarKlier — Thu, 19 Sep 2024 18:51:35 GMT

Hello,

Just thinking outside of the box, have you looked into dynamic DNS?

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-networking-admin/ddns/configure-dynamic-dns-for-firewall-interfaces

Regards,

Re: IPsec to Azure with a DHCP WAN IP + SDWAN + GlobalProtect

skullbox15 — Fri, 20 Sep 2024 19:11:00 GMT

Thanks for the reply... The WAN IPs don't actually change much. Maybe once a year or if I change out the modem that feeds the firewall. My requirement to using the loopback interfaces stems from the PAs not allowing you to specify an interface for the IPsec/Global Protect that is a DHCP address. If I were able to set them as static, I could just use the actual interface instead of the loopback.
I was able to get Global Protect working using a loopback after some trial and error. Maybe I'll throw up the Azure side and try to re-configure the PA side and show the config I'm trying to use and post them here. From what I remember last time, I was getting a commit error about multiple loopback addresses and when I tried to use the same loopback interface for both GP and IPsec it bawked at that as well.