topic Re: Site-to-Site VPN question in General Topics

Site-to-Site VPN question

Bvance — Tue, 22 Sep 2015 22:47:54 GMT

I'm setting up a site-to-site VPN with static routes, which means the tunnel interface doesn’t need an IP address. But I would like to turn on tunnel monitoring and that does require an IP address on the tunnel interface. My question is does this IP need to be an actual publicly accessible IP or is it just two private IP's I define, both VPN peers in the same scope, for pinging?

Re: Site-to-Site VPN question

_slv_ — Wed, 23 Sep 2015 07:05:10 GMT

Hi Bcance

Please follow this doc https://live.paloaltonetworks.com/t5/Configuration-Articles/Dead-Peer-Detection-and-Tunnel-Monitoring/ta-p/61371

In my opinion You can use any two private IP's.

Regards

Slawek

Re: Site-to-Site VPN question

pankaku — Wed, 23 Sep 2015 08:37:55 GMT

You can use any IP address for tunnel interface just make sure that ip adddress on tunnel interface of both side are in same subnet. For example you can use 192.168.1.1/30 and 192.168.1.2/30.

Re: Site-to-Site VPN question

Bvance — Wed, 23 Sep 2015 17:26:35 GMT

Thanks for you help pakumar.

Re: Site-to-Site VPN question

Bvance — Wed, 23 Sep 2015 17:26:53 GMT

Thanks slv