topic Re: VPN between 2 Palo Alto Firewalls in General Topics

VPN between 2 Palo Alto Firewalls

harmander — Wed, 24 Aug 2016 05:54:23 GMT

Hi there,

I am trying to setup VPN between 2 Palo Alto Firewalls. On one side I have public address but on the other side I am using a private ip address as this Palo Alto is behind a router. The VPN is not coming up. I also tried to do port forward from the router to the Palo Alto but still no success. What am I doing wrong here guys or will it work with this kind of setup at all?

Thanks

Re: VPN between 2 Palo Alto Firewalls

emr_1 — Wed, 24 Aug 2016 06:10:38 GMT

Are you enabling NAT Traversal?

What does system-log say on both sides?

System log would be a hint to troubleshoot.

Re: VPN between 2 Palo Alto Firewalls

TranceforLife — Wed, 24 Aug 2016 07:03:24 GMT

Hello,

Here is a good explanation what is NAT-T:

http://www.internet-computer-security.com/VPN-Guide/NAT-T.html

Encapsulating IPSEC in UDP is likely to require an adjustment to the MSS on the firewall and on devices between the firewall and the internet because of the extra headers.

https://live.paloaltonetworks.com/t5/Configuration-Articles/NAT-Traversal-in-an-IPSEC-Gateway/ta-p/61948

After all this done,

Please check/post your ike logs, better from the responder side or both:

> tail lines 50 mp-log ikemgr.log

Thx,

Myky