topic IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA in General Topics

IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

fozail — Sun, 04 Dec 2016 09:46:51 GMT

Hi There,

I was migrating configuration from Juniper to PA, everything worked as expected except IPSEC VPN.

Customer has two sites and both sites have ADSL connection with Dynamic IP address, however on one end Dyn DNS is used. In the below example Site-A has Dyn DNS and www.vpn.com gets updated as soon as IP gets changed on Site-A. But on PA there is no option to configure FQDN for static peer only IP address. However on Juniper you can select peer as Static and you can configured IP/FQDN, even though peer is dynamic you can select it as static and configure the FQDN "www.vpn.com" and Site-B fires IPSEC VPN traffic and works like a charm.

Below is the example, where you can configure FQDN on Juniper, I was wondering that does PA has any plan to allow both IP and FQDN if you select peer type as Static like Juniper.

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

Fitaihi_NetworkAdmin — Mon, 05 Dec 2016 06:10:57 GMT

IN Palto firewall if you are using dynamic ip .. please select as below.. the you can established site to site vpn

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

santonic — Mon, 05 Dec 2016 07:11:34 GMT

That could work. But you need to make sure the other side uses FQDN for phase 1 identification. From that Juniper screenshot FQDN is used only for getting the IP for transport while peer ID is left empty.

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

TranceforLife — Mon, 05 Dec 2016 10:03:23 GMT

Hi,

Agreed with the comments above. Make sure PA can resolve FQDN of the peer (bi-directional). DDNS has to be configured for the both peers

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

fozail — Mon, 05 Dec 2016 15:29:49 GMT

Hi,

I configured peer identification as FQDN, but PA does not fire IPSEC VPN. Enabled debug for ikemgr.log and could see that "can't initiate IPSEC VPN for Dynamic peer".

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

TranceforLife — Mon, 05 Dec 2016 16:08:38 GMT

Hi,

Post the IKE Gateway config and logs from the both devices if possible.

Can you resolve the FQDN for the remote peer? Can peer resolve yours? Can you reach the peer with simple ping? How about your security policies. Do you have IPSEC traffic permitted on the untrust interface (same zone traffic untrust>untrust)? (you can enable management profile for outside interface for the test)

Thx,

Myky

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

BPry — Mon, 05 Dec 2016 16:07:15 GMT

You likely have a configuration error on the IKE gateway, I assume that the security policy to allow the traffic has already been generated on both devices. To clarify this connection is between two Palo Alto devices right, it isn't a Palo Alto to something else?

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

fozail — Mon, 05 Dec 2016 16:20:03 GMT

Hi,

Yes I can resolve the FQDN of peer. I can reach to peer (ping source X.X.X.X host www.xyz.com).

I don't see any traffic reaching on remote peer.

A security policy has been configured on both end to allow IPSEC traffic.

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

TranceforLife — Mon, 05 Dec 2016 16:28:36 GMT

Hi,

What is on the remote side (device)? Logs will help. Also, who is an initiator of the tunnel? Best to check responder side logs.

Can you provide the logs?

Thx,

Myky

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

fozail — Mon, 05 Dec 2016 16:30:57 GMT

Hi All,

Got the confirmation from PA TAC that tunnel can't be stablished if both peer is DYNAMIC, one end has to be static.

But it is supported on Juniper, henec I will raise a feature request for this.

Thank you for your help.

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

TranceforLife — Mon, 05 Dec 2016 16:32:30 GMT

Hi,

Very good info)) I always thought you can with PA. Theoretically should work

Thx,

Myky

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

BPry — Mon, 05 Dec 2016 18:10:17 GMT

Same, I guess I never had a need for both ends to be dynamic.

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

fozail — Mon, 05 Dec 2016 18:58:20 GMT

Yes, I concur with you. I had an impression that if FQDN gets resolved to an IP, it should work.

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

santonic — Tue, 06 Dec 2016 07:16:29 GMT

FQDN in this case is just an ID for phase 1. If peer is set as dynamic, PA can't know to which IP address to send the packet to. I assumed you have static IP on PA and the other gateway could be initiator. And yeah, if both gatways have dynamic IP nobody can know to what IP to send packets to start negotiation.

In Juniper case i guess FQDN was just a mechanism to feed IP to FW and IPSEC was basically set as static to static. Which I agree is a good feature to have.

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

TranceforLife — Tue, 06 Dec 2016 16:54:47 GMT

Yep this is what l thought so that PA resolve a DNS>IP before initiate a tunnel P1

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

fozail — Wed, 07 Dec 2016 13:31:27 GMT

Yes, you are correct. It's jsut a peer identification. As both peer is dynamic and hence does not know IP address of peer. So tunnel can't be initiated by any peer.

If we have one one end as static and other as dynamic, who has dynamic can always initiate the tunnel as it's local IP is dynamic but it knows peer IP.

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

pulukas — Thu, 08 Dec 2016 11:13:25 GMT

Unfortunately, the feature to use a FQDN instead of an IP address for a remote VPN gateway is a rare one in the site-to-site VPN world. As you picture, SceeenOS had this feature and Sonicwall was the only other one I've worked with that allowed this configuration option. This is very convenient but rare.

Even Juniper only semi migrated this to Junos. They allow you to enter an FQDN gateway when you do a VPN configuration but Junos simply uses this to resove the CURRENT address for the FQDN then stores and uses the actual IP address in the configuration.

So the bottom line here is one side will need to have an IP address gateway entered to get a configuration to initiate and come up.

Re: IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

fozail — Fri, 09 Dec 2016 14:44:23 GMT

Hi, Yes, you are correct. One end should have static IP address to establish the IPSEC VPN.