topic Re: Configuring the Proxy-ID for phase 2 IPSec using PAN 6 CLI in General Topics

Configuring the Proxy-ID for phase 2 IPSec using PAN 6 CLI

palomed — Sat, 22 Apr 2017 00:30:40 GMT

there's this great example below for setting up an IPSec tunnel using the CLI. BUT it's missing how to add in the proxy IDs.

I have some clues that it's like..

set network tunnel ipsec IPSEC-Tuna-TUNNEL proxy-id tuna1 protocol any Local xxxx Remote yyyy

..but I'm just guessing. Can anyone supply me with the real mojo - perhaps from a cleaned working example? TY

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-an-IPSEC-VPN-with-Route-and-Tunnel/ta-p/58539

Re: Configuring the Proxy-ID for phase 2 IPSec using PAN 6 CLI

bradk14 — Sat, 22 Apr 2017 03:17:22 GMT

performing my favorite trick of configuring in the GUI, then checking the config in the CLI in set mode, it looks like the following to me:

set network tunnel ipsec XXX auto-key proxy-id YYY protocol any
set network tunnel ipsec XXX auto-key proxy-id YYY local ZZZ/Z
set network tunnel ipsec XXX auto-key proxy-id YYY remote ZZZ/Z

but it looks like it can all be combined in a single line like you expressed.

set network tunnel ipsec XXX auto-key proxy-id YYY protocol any local ZZZ/Z remote ZZZ/Z

Re: Configuring the Proxy-ID for phase 2 IPSec using PAN 6 CLI

palomed — Sat, 22 Apr 2017 04:19:58 GMT

That's a big help. Thanks. Say - do you know what the auto-key term in the middle is about?

Re: Configuring the Proxy-ID for phase 2 IPSec using PAN 6 CLI

TranceforLife — Sat, 22 Apr 2017 19:38:03 GMT

Sorry for intrusion:

So better to keep it on auto.