topic Re: PA support point to multipoint IPSEC VPN? in General Topics

PA support point to multipoint IPSEC VPN?

ghostrider — Fri, 28 Oct 2016 20:38:33 GMT

Hello

Does PA support point to multipoint IPSEC in hub and spoke VPN envorirnmet? Means Only one tunnel interface we create on hub and through NHTB protocol, nexthop is bind to SA.

Regards,

Re: PA support point to multipoint IPSEC VPN?

nextgenhappines — Sat, 29 Oct 2016 00:55:09 GMT

The feature is called Large Scale VPN (LSVPN)

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/large-scale-vpn-lsvpn

Re: PA support point to multipoint IPSEC VPN?

ghostrider — Sat, 29 Oct 2016 14:39:16 GMT

Hello

Thanks for the reply. I will go through this. It seems like getvpn of cisco or group vpn of juniper srx. I just want to know that for traditional hub and spoke VPN, hub has to confiugre one tunnel interface per spoke. Is there way we can confiugre only one tunnel interface making it point to multipoint like in Juniper and Cisco DMVPN

Re: PA support point to multipoint IPSEC VPN?

pulukas — Sun, 30 Oct 2016 12:25:20 GMT

No, Large scale VPN is NOT point to multi-point tunnels. Rather this is a method to use SSL VPN in order to semi-automate with minimal config getting VPN setup from remote sites to the hub.

Currently I can find no additions to the PA VPN instructions for point to multi point tunnels. The hub and spoke documentation lists using separate tunnels for each site as routed links

https://live.paloaltonetworks.com/t5/Tech-Note-Articles/Configuring-Hub-and-Spoke-Route-based-VPN/ta-p/56193

You should contact your sales engineer to discuss future feature release plans as PA won't discuss these in public forums. You should also confirm that point to multi point tunnel interfaces are already in the "Feature Request" database and add your company vote for the feature.

Re: PA support point to multipoint IPSEC VPN?

ghostrider — Sat, 05 Nov 2016 19:14:26 GMT

thank you