Paloalto routing an IPSEC tunnel to another router

alexcoxie — Tue, 24 Jun 2025 07:46:39 GMT

Hello, I'm trying to create a tunnel between R1 (OpnSense) and R3 (Sophos), R2 is the Paloalto that NATs a dedicated wan IP to interface1/2 (private TRUST LAN) where is locally connected the Sophos.

R1 (Opnsense) <-----> R2 (Paloalto NAT 1:1) <-----> R3 (Sophos)

I have setup all the IPSEC IKE2 tunnels on R1 and R3, on R2 i did the NAT1:1 with Dinamic IP and Port on both inbound and outbound sides, so the clients on R3 have the Public IP that i set, the NAT is working fine with the TCP ports.

NAT

Security (86 apps seen)

The problem is the the tunnel is not initialized, I can't see any package arriving from the R1 to R2 on UPD 500/4500.

what could be? It is possible to do this configuration ? (R2 routes the tunnel between R1 and R3 only with a NAT?)

Thank you.

Re: Paloalto routing an IPSEC tunnel to another router

OtakarKlier — Tue, 24 Jun 2025 16:23:30 GMT

Hello,

Do you also have the appropriate security policies in place to allow the traffic? Check the Unified logs to see if the traffic is allowed or blocked.

Regards,

topic Paloalto routing an IPSEC tunnel to another router in General Topics

Paloalto routing an IPSEC tunnel to another router

Re: Paloalto routing an IPSEC tunnel to another router