topic Re: IPSEC VPN through PAN comes up but does not pass traffic in General Topics

IPSEC VPN through PAN comes up but does not pass traffic

tuckert — Thu, 15 Aug 2013 20:59:04 GMT

What needs to be enabled to allow a VPN that once worked to be allowed through a 3020. I had a Juniper to Juniper IPSEC VPN that worked before the 3020 was placed between the 2 junipers. What needs to be allowed to make sure that the traffic passes.The VPN comes up,but no data is able to pass

Re: IPSEC VPN through PAN comes up but does not pass traffic

kprakash — Thu, 15 Aug 2013 21:05:39 GMT

Please check if

1) you have the correct proxy ids configured on both the firewalls ( the local and the remote networks must be mirror images on both the firewalls )

2) You have the routes configured on the tunnel interface for the remote network ( If the Juniper firewalls supported policy based VPNs, we do not have tunnel interfaces and hence no routes for the remote network, on the Juniper firewall)

3) Check if you have the policies configured correctly for the zones ( the tunnel interface should be assigned to a zone and a virtual router, and we must have the appropriate policies in place to allow end to end traffic)

BR,

Karthik

Re: IPSEC VPN through PAN comes up but does not pass traffic

mbutt — Thu, 15 Aug 2013 22:58:01 GMT

In addition to what karthik said below doc explains Why is a Proxy-ID Required for VPNs between PAN and Firewalls that Support Policy Based VPNs?

https://live.paloaltonetworks.com/docs/DOC-3073

Hope this helps you resolve the issue.

Thanks

Numan