topic Re: Pa VPN IPsec in General Topics

Pa VPN IPsec

atelcom — Tue, 04 Nov 2014 14:16:40 GMT

Hi,

i have a question regarding the VPN IPsec on Paloalto , is palotlo must be in front end when configuring the PA

Regards,

Sarah

Re: Pa VPN IPsec

HULK — Tue, 04 Nov 2014 14:20:44 GMT

Hello Sarah,

Could you please explain, what do you mean by "front end". It will help us to understand your exact requirement.

Thanks

Re: Pa VPN IPsec

ssharma — Tue, 04 Nov 2014 14:23:11 GMT

Hi Sarah,

No that is not a requirement. You can use it as Pass through device as well, where it treats IPSec traffic as any other traffic and allows or denies as per policy configured. Though there are benefits with respect to threats, replay attacks when you configure it as front end or edge device but that is not a requirement.

Hope this helps. Thank you.

Re: Pa VPN IPsec

atelcom — Tue, 04 Nov 2014 14:27:41 GMT

here is the architecture,i want to know if the vpn ipsec must be configured on the stonsoft ,

or we can do that in the PA with private addresses

Re: Pa VPN IPsec

atelcom — Tue, 04 Nov 2014 14:29:03 GMT

Yeah i know that,but i want to know if i can configure the vpn ipsec on the paloalto with private adresses

thank you

regards,

Sarah

Re: Pa VPN IPsec

HULK — Tue, 04 Nov 2014 14:30:31 GMT

Hello atelcom ,

Yes, You can configure the VPN tunnel with Private IP.

Thanks

Re: Pa VPN IPsec

ssharma — Tue, 04 Nov 2014 14:30:56 GMT

Yes, you can configure it with private address as well. The requirement is same as with public IP all phase 1 and phase 2 should match. Otherwise there is no difference. Hope this helps. Thank you.

Re: Pa VPN IPsec

HULK — Tue, 04 Nov 2014 14:37:11 GMT

Hello Sarah,

You may follow this KB article How to Configure IPSEC VPN

> Make sure PAN has been always the VPN initiator ( enable "passive mode" in other end device)

> Enable NAT-Traversal on both end firewalls.

Thanks