topic Dynamic VPN in General Topics

Dynamic VPN

Ovan — Mon, 11 Jan 2010 07:41:36 GMT

Dear PaloAlto Support,

Does Palo Alto support this VPN feature such as Dynamic VPN or Easy VPN?

Customer will use Cisco Router at their branches. They want to connect VPN from all branches to their HQ. All branches will have dynamic IP and HQ will have static IP.

Thanks,

Re: Dynamic VPN

nrice — Mon, 11 Jan 2010 18:10:45 GMT

Hi Ovan,

PAN devices don't support Cisco's proprietary Dynamic Multipoint VPN or Easy VPN. You can configure the PAN to create tunnels with third party security devices, however. Connections between the central site and multiple remote sites would require VPN tunnels for each central-remote site pair and configuration of appropriate policies, DH parameters and encryption algorithms.

Re: Dynamic VPN

Ovan — Fri, 15 Jan 2010 04:29:38 GMT

Thank nrice,

But If I want to test Dynamic VPN with 2 PaloAlto appliance, can I?

I have 2 line Internet:

+Line 1:

-IP Public: 123.21.40.167 (dynamic IP)

-Modem's IP: 172.16.1.254/24

-PaloAlto1 Layer 3: Zone-Internet: 172.16.1.120/24

Zone-LAN: 192.168.5.0/24

-Modem NAT port 1723 to IP 172.16.1.120

+Line 2: 222.253.113.230 (static IP)

-Modem's IP: 192.168.81.254/24

-PaloAlto2 Layer 3: Zone-Internet: 192.168.81.98/24

Zone-LAN: 192.168.2.0/24

-Modem NAT port 1723 to IP 192.168.81.98

Both 2 PaloAlto, I configured IKE Gateway to point direct 2 IP public (still not use Dynamic option) but when I SSH to PaloAlto, and type 'show vpn flow' the state is init (not inactive) (please refer the attached file: Snapshot VPN-SSH.jpg).

I want to test Dynamic VPN, but I want to ensure that IPSec VPN running well first.

I uploaded some snapshots and the configuration file, please refer the attached files and help to solve this problem.

Many thanks,

Ovan

Skype: ovan_pham

Re: Dynamic VPN

nrice — Fri, 15 Jan 2010 22:51:45 GMT

Ovan,

Please contact Support so that they can assist you with your configuration.