topic Re: Tunnel between PaloAlto and PaloAlto in General Topics

Tunnel between PaloAlto and PaloAlto

Hithead — Thu, 18 Jul 2013 13:59:12 GMT

Hello,

i'm trying to get this constellation running:

Two PA 200 behind a DSL-Home-Router and a firewall with a fixed public IP at the passive site.

This image is just an example how it looks like....

First i want to get the active site ("PA-Active"; PA 200; Version 5.0.6) running...

I configured the IKE Gateway, Tunnel interface and also the IPSec Tunnel, but the PA doesn't want to establish/initialize the connection at all...I cannot see any log files in "traffic" either in "system"...Firewall policies should allow the traffic...

Here are the settings i made:

Can someone help? Did i missed a config?

Re: Tunnel between PaloAlto and PaloAlto

kprakash — Thu, 18 Jul 2013 14:13:36 GMT

Hi Hithead,

Do you have a policy to permit ike and ipsec application from the untrust zone to the untrust zone, if at all there is a clean up rule at the bottom of the firewalls ?

What are the IKE identities that you are using on the remote PA firewalls?

Re: Tunnel between PaloAlto and PaloAlto

kprakash — Thu, 18 Jul 2013 14:15:22 GMT

Are you also permitting ike and ipsec traffic on the firewall 2?

To rephrase my earlier question, may I know what local and remote peer IDs have been configured on each of the PA 200s?

Re: Tunnel between PaloAlto and PaloAlto

rmonvon — Thu, 18 Jul 2013 14:20:12 GMT

Hi...You need to add a static route for the IP network that is found across the tunnel. Let's say the remote LAN has IP subnet 10.11.12.0/24. You would add static route dest=10.11.12.0.24 use interface=tunnel.2. Then you need to generate traffic like pinging a host at 10.11.12.x to force traffic to the tunnel & bring the tunnel up. Thanks.

Re: Tunnel between PaloAlto and PaloAlto

ericgearhart — Thu, 18 Jul 2013 14:25:15 GMT

The static route is the thing that's needed as said.

Also I would suggesting building a tunnel monitoring profile on both sides... I have Palo Alto to Palo Alto IPSec tunnels in production, and I noticed that the tunnels wouldn't come back up if I rebooted one side of the tunnel without tunnel monitoring in place (which kind of makes sense.. the IPSec SA was never being torn down on one side, I had to clear it manually to get the tunnel back up).

I will say that my PA to PA tunnels have been rock solid though, after that one little gotcha.

Re: Tunnel between PaloAlto and PaloAlto

Hithead — Thu, 18 Jul 2013 14:41:46 GMT

Hi,

i added 10.0.0.0/8 (because all traffic should go through the tunnel)...And also make a ping from the interface 1/1... and still no reaction or something else to initialize a tunnel...

Re: Tunnel between PaloAlto and PaloAlto

ericgearhart — Thu, 18 Jul 2013 14:56:57 GMT

Do you have a catch all NAT policy configured on your PA? If you do, you need to set up a noNAT for the traffic you're trying to send over the tunnel. That's usually the culprit when I can't figure out why a tunnel isn't seeing interesting traffic and coming up

Re: Tunnel between PaloAlto and PaloAlto

Hithead — Thu, 18 Jul 2013 15:07:46 GMT

Hi..

no there is no NAT configured for this traffic.

Can you please do me a favour and provide some screenshots of your configuration?

Because i'm really confused why my PA didn't try to establish a VPN tunnel...

Re: Tunnel between PaloAlto and PaloAlto

rmonvon — Thu, 18 Jul 2013 15:16:29 GMT

Your traffic log shows the ping are being dropped so the tunnel will not come up. Make sure you have a security rule allowing the traffic to the tunnel zone. Thanks.

Re: Tunnel between PaloAlto and PaloAlto

kprakash — Thu, 18 Jul 2013 15:28:38 GMT

Hi HIthead,

I am still wondering if the Phase-1 is getting established or not. Are the phase 1 and the phase 2 up?

>show vpn ike-sa

>show vpn ipsec-sa

I have an apprehension that we are failing in the negotiation itself.

BR,

Karthik

Re: Tunnel between PaloAlto and PaloAlto

ericgearhart — Thu, 18 Jul 2013 18:47:07 GMT

As said, there are denies in that log you posted. You probably want to resolve letting traffic over the tunnel zone first. Your config looks ok from the screenshots you're posting... this was a very straightforward process when I went to set up a PA-PA tunnel.

Re: Tunnel between PaloAlto and PaloAlto

Hithead — Fri, 19 Jul 2013 14:01:03 GMT

Thanks a lot,

after allowing ping to the tunnel zone the PA tries to establish a tunnel.

BUT, now i need to get NAT Traversal running. Because both PAs are behind a NATing firewall and DSL router, so the IKE will be lost on the way... In the IKE gateway settings i enabled the NAT traversal option and the PA still try to use IKE Port UDP500... Is it correct? Or how can i solve the NAT problem to prevent the UDP packet lost?

Thanks

Re: Tunnel between PaloAlto and PaloAlto

Hithead — Sat, 20 Jul 2013 17:24:12 GMT

Don't know if you understood the problem...but...

The IKE UDP packet doesn't get received at the other end... Does IKE works with NAT? Have i change something at PA or somewhere else to get it run?

Re: Tunnel between PaloAlto and PaloAlto

HULK — Sat, 20 Jul 2013 18:20:55 GMT

Hi,

Could you please make the PA firewall as initiator which is behind the dynamic public IP address. Also set the IKE negotiation in aggressive mode. Since we don't have any address to use to contact the peer ( to the dynamic side). . Also set the IKE gateway "Peer type" as dynamic with a suitable local and peer identification ( FQDN, IP address, email Address).

Thanks

Gantait

Re: Tunnel between PaloAlto and PaloAlto

HULK — Sat, 20 Jul 2013 18:30:35 GMT

Hi,

Please find below mentioned document, hope it will help you.

Thanks

Gantait

Re: Tunnel between PaloAlto and PaloAlto

Hithead — Mon, 22 Jul 2013 11:59:39 GMT

hi,

it seems to work now. But the problem was the ISP at the other side (doesn't allowed the protocols). After switching to an other public subnet it works. Thanks a lot guys!

Re: Tunnel between PaloAlto and PaloAlto

ericgearhart — Mon, 22 Jul 2013 14:29:13 GMT

Good to hear it's working. Can you please mark this question as answered?