topic Add second ip to tunnel interface in General Topics

Add second ip to tunnel interface

jorgdc — Mon, 08 Oct 2012 07:56:49 GMT

Hello All,

I am wondering if it is possible to add a second IP to a tunnel interface. I want to add some extra IPs to a tunnel interface (/28 subnet). To allow a remote party to connect to some servers in our internal network using NAT over IPsec tunnel. I have been looking at both CLI and GUI both cannot find it.

Kind regards,

Jorg

Re: Add second ip to tunnel interface

ppatel — Mon, 08 Oct 2012 09:03:35 GMT

I think you are taking about the proxy id's here, correct me if I am wrong.

Tunnel Monitoring is used to keep a VPN tunnel communicating with the other VPN endpoint. If a tunnel monitor profile is created it will specify one of two action options if the tunnel is not available; wait-recover or fail-over.

For tunnel monitoring, under Network> Ipsec Tunnels > Advance Options, the destination ip-address would be a single Ip-address.

Secondary ip-address cannot be configure on the tunnel interface under Network > Interfaces > Tunnel

However, you can set proxy ids to achieve this where you can keep the local private subnet in "local" field and the remote private subnet under "remote" field. The same proxy ids also need to be set on the other side but the local and the peer subnets would be reversed.

Regards

Re: Add second ip to tunnel interface

jorgdc — Mon, 08 Oct 2012 09:26:11 GMT

The tunnel was allready setup and working and filled in the proxy ids for remote and local.

Have added one IP to tunnel inferface which we use for source nat to the other party. Works allready.

We just now want to make some servers accessible to the other party on a couple of IPs in the same /28 range. On our previous firewall we needed to create the interface first on every tunnel before we could destination nat. Is this also the case for PA.

Kind regards,

Jorg

Re: Add second ip to tunnel interface

kalavi — Mon, 08 Oct 2012 20:03:18 GMT

Hey Jorg,

You can define the subnet (/28) in the IP address section of the tunnel interface. Now from that subnet you use the rest of the other IP addresses to create the Destination NAT policies based on the requirements. I have tested this in my lab and everything works as expected. Let us know if you have any questions.

Khubaib