topic Re: How to configure PAN to Azure VPN tunnel in General Topics

How to configure PAN to Azure VPN tunnel

bjdraw — Mon, 11 Mar 2013 12:56:30 GMT

I'm sure I'm not the first one to do this, but since I wasn't able to find a document on how exactly to do it, I figured I'd contribute one. I'd appreciate any corrections or optimizations.

The Azure side documentation is pretty clear online and honestly there aren't many options available to configure. But here are is my Azure address space for clarification.

And my defined local networks, with a gateway address of my PAN VPN endpoint.

Next I configured the Tunnel interface, which is pretty vanilla, just have to assign an IP on the same subnet as the Azure Gateway Subnet (I used the last usable IP on the subnet), select a virtual router and the appropriate security zone (the zone I selected is the same as the one my other servers are on, so I don't need new policies).

The settings of my default IKE Crypto profile were the same as for Azure, but here they are just in case.

I had to create a new IPSec Crypto Profile for Azure due to the 3600 lifetime instead of lifetime on my other tunnels (you can modify the default if this is your only tunnel or if your other tunnels use the same settings).

Create an IKE Gateway selecting the external interface of your PAN and the IP of that interface for "Local IP Address" (this will match the VPN Gateway Address configured on the Local Address in Azure that you're tunneling to). The Peer IP Address can be obtained from the Azure Virtual Network Dashboard of the same Azure Virtual Network. The Local Identification IP Address should match the Local IP Address on the same screen. The Pre-shared Key can be obtained by clicking "Manage Key" on the Azure Virtual network Dashboard of the Azure Network, then copy and paste it

Now create a new IPSec Tunnel with the newly created Tunnel Interface, IKE Gateway and IPsec Crypto Profile.

Go to the Proxy IDs tab and create at least one ID with the appropriate local and remote subnets (Local should matched the defined "Local Networks" you configured in Azure with the appropriate gateway address of your PAN IPSec tunnel endpoint and remote should match the configured Azure address space).

Finally create a route to direct traffic via the tunnel interface to the Auzre Virtual Network.

At this point a ping to the Azure Virtual Network should bring the tunnel up, if not, check the System log to troubleshoot (at this time no ping responses are received, but other traffic is working, need to figure that one out).

Re: How to configure PAN to Azure VPN tunnel

Retired Member — Mon, 03 Jun 2013 14:32:15 GMT

very good document.Thanks.

Re: How to configure PAN to Azure VPN tunnel

mikand — Mon, 03 Jun 2013 17:56:28 GMT

Hopefully some paloalto-person can make a DOCS version of above 🙂

Re: How to configure PAN to Azure VPN tunnel

zp0192g — Fri, 05 Jul 2013 18:03:58 GMT

Thanks for taking the time to document and share your solution.

Re: How to configure PAN to Azure VPN tunnel

VinceM — Mon, 08 Jul 2013 07:16:47 GMT

Hi,

Thx for your time and your shared. Great Job

Re: How to configure PAN to Azure VPN tunnel

ITNetworksTeam — Mon, 07 Oct 2013 08:46:48 GMT

Hi,

Thanks for the doc. Just an addition, when you setup the gateway on the Azure side you need to make sure you chose the "static routing" option. With "dynamic routing" selected Azure will default to using IKE v2 which the PA does not appear to understand and hence will not complete Phase 1 negotiation (Notify Message Type: NO-PROPOSAL-CHOSEN (14)).

Re: How to configure PAN to Azure VPN tunnel

terence.lee — Mon, 05 Jan 2015 06:55:10 GMT

I have seen an incident where the only change to make VPN stable is we disabled Dead Peer Detection, which is not supported per Microsoft's doc and not found in Azure ASA template configuration.

http://msdn.microsoft.com/en-us/library/azure/jj156075.aspx

For the Phase 2 Security Association (SA) Lifetime (Throughput), Azure uses 102,400,000 KB. However we are not able to use this value on PA. I think this is not significant. However, I can have this field blank in my lab. My PANOS version is 6.0.6.

Re: How to configure PAN to Azure VPN tunnel

pulukas — Mon, 05 Jan 2015 22:48:52 GMT

Just adding the official PA document for Azure VPN to the thread.

How to Configure VPN Tunnel Between a Palo Alto Networks Firewall and Azure

Re: How to configure PAN to Azure VPN tunnel

CDIPAN — Thu, 13 Aug 2015 18:54:08 GMT

I'm not sure if this document has been updated, I thought it might be useful for people to know that PAN OS prior to 7.0 only use IKEv1 and do not support the Windows Azure Dynamic Routing, Static Routing is required when using IKEv1 with PAN OS prior to v7.0