topic Re: How to setup IPSEC VPN tunnel between PA-3020 with PA-200 in General Topics

How to setup IPSEC VPN tunnel between PA-3020 with PA-200

RonaldB — Sat, 28 Dec 2013 06:01:26 GMT

I would like to know if there is a way we can setup two PA to talk over VPN for eg:

1- PA-3020 at HQ .

2 - PA-200 in our branch office.

I would like my PA-200 to connect with PA-3020 over IPsec VPN and at our branch office we have DSL connection. If someone has done this kind of setup please I would like you input.

Re: How to setup IPSEC VPN tunnel between PA-3020 with PA-200

sraghunandan — Mon, 30 Dec 2013 19:08:25 GMT

Please refer to the following links

https://live.paloaltonetworks.com/docs/DOC-1163 --2nd Document

https://live.paloaltonetworks.com/docs/DOC-5715

Re: How to setup IPSEC VPN tunnel between PA-3020 with PA-200

SimmSimm — Thu, 02 Jan 2014 12:22:53 GMT

Well I can confirm that it works fine - The only thing to think about from me is to make sure that the PA200 talks to the internet without the DSL router filtering out traffic - I always try to get a proper external static IP when deploying in that sort of situation but it may not be possible in all cases & so you need to watch out for NAT & router - firewall problems.

Re: How to setup IPSEC VPN tunnel between PA-3020 with PA-200

skrall — Fri, 03 Jan 2014 04:06:52 GMT

Do you have a security rule at the and that drops traffic from any zone to any zone, any application, any source to any destination?

This ANY/ANY/DROP rule will break VPNs and routing protocols.

Your Tunnel termination is effectively originating on the UNTRUST zone and terminating on the UNTRUST zone.

Create an additional Security policy that allows APP = IPSEC and IKE from UNTRUST to UNTRUST and place this rule before the DENAY all rule and the problem should be resolved.

SKrall

Re: How to setup IPSEC VPN tunnel between PA-3020 with PA-200

stjorgens — Mon, 18 Sep 2017 18:07:26 GMT

links dont work....