topic Re: S2S IPsec VPN with Multiple Domain Encryption in General Topics

S2S IPsec VPN with Multiple Domain Encryption

R.Thakar — Mon, 02 Feb 2026 06:00:06 GMT

We have experiencing difficulties having more than one domain encryption in IPsec tunnel, specifically when both are in the same subnet. Only one domain encryption remains active in the IPsec phase2. There are few times you can bounce IPsec gateway and restore connection to affected domain encryption, but after some time again connection lost to the node. Please assist.

#PA1420

Re: S2S IPsec VPN with Multiple Domain Encryption

Raido_Rattameister — Mon, 02 Feb 2026 14:09:03 GMT

Palo can't care less about ProxyID's / encryption domains.

They are there only to make peer side happy when peer supports policy based VPN.

Palo uses routing table to decide where traffic should go to.

If you have 2 Palos, then you don't need to use ProxyID at all and then both sides will send 0.0.0.0/0 over to each other behind the scenes.

Re: S2S IPsec VPN with Multiple Domain Encryption

R.Thakar — Tue, 03 Feb 2026 10:56:28 GMT

I have PA1420 on my side but remote Peer has Cisco NGFW using Policy based VPN. how will these two behave on handling multiple domain encryptions?

Re: S2S IPsec VPN with Multiple Domain Encryption

Raido_Rattameister — Tue, 03 Feb 2026 13:31:25 GMT

Ok in this case you do need ProxyIDs.

You mentioned they are overlapping.

Can you bring few examples how they overlap?

Re: S2S IPsec VPN with Multiple Domain Encryption

R.Thakar — Thu, 05 Feb 2026 05:19:47 GMT

sorry, I cant recall how I used the word "overlapping". But the how it was is, we have one Domain encryption on PA side, and two Domain encryption from remote peer who are using cisco NGFW. And,

Kind of strange, I tried to create rule for each domain encryption and put /32 on each IP and seems okay now. Any idea on this?

Re: S2S IPsec VPN with Multiple Domain Encryption

Raido_Rattameister — Thu, 05 Feb 2026 13:39:11 GMT

I interpreted "specifically when both are in the same subnet" as "overlapping".

Palo does not try to keep tunnels/proxyid's/encryption-domains active if there is no traffic trying to pass tunnel.

So if your Phase 2 timeout is 1 hour and no traffic for this time then tunnel is taken down.

If it bothers you, then you can configure tunnel monitoring in IPSec config or path monitoring in virtual router to keep tunnels up.