topic Re: Can firewall act as VPN client? in General Topics

Can firewall act as VPN client?

Nick1 — Thu, 06 Jun 2013 06:17:17 GMT

Wondering if we can configure a lab PA-200 to connect to a VPN concentrator on the internet using IPsec, as though it were a VPN client not a site-to-site tunnel. Not connecting to the firewall using GP, but using the firewall itself as the VPN client...and then use routing or tunnel interface to receive interesting traffic sent to firewall that would then be routed out the VPN tunnel by the firewall

Re: Can firewall act as VPN client?

sraghunandan — Thu, 06 Jun 2013 18:21:06 GMT

Please refer this document I think this is what you are looking for

https://live.paloaltonetworks.com/docs/DOC-4078

Re: Can firewall act as VPN client?

sraghunandan — Thu, 06 Jun 2013 18:22:46 GMT

And also https://live.paloaltonetworks.com/docs/DOC-4139

Re: Can firewall act as VPN client?

Nick1 — Thu, 06 Jun 2013 21:44:51 GMT

I am wondering more along the lines of using the PA-200 as a VPN client to a non-Palo Alto VPN concentrator, like a Cisco ASA. Say for instance big Company A's central office has an ASA but only allows IPsec client connections to it, will not allow site-to-site tunnels. Then they purchase a new Company B with 15 employees in another town that has a PA-200 as their office firewall. Rather than setting up AnyConnect VPN client on all 15 employee workstations in Company B to connect to Company A, could I configure Company B's PA-200 to establish the client VPN connectivity one-time centrally and then route all Company B's non-internet server RDP traffic to Company A's datacenter through the VPN tunnel

Re: Can firewall act as VPN client?

sraghunandan — Thu, 06 Jun 2013 22:07:39 GMT

Hi Nick,

I don't think that's possible.the only way out is an ipsec site to site tunnel .

Re: Can firewall act as VPN client?

JRussell — Fri, 07 Jun 2013 09:17:56 GMT

I'm with sraghunadan here. I don't think it was ever intended to be used in that way, and trying to get it to work in this way would probably just waste your own time

Re: Can firewall act as VPN client?

mikand — Fri, 07 Jun 2013 18:57:33 GMT

I think the LSVPN setup will use the devices as "clients" but I think its more of a semantics thingy.

What actually happends is that the device setups a tunnel towards the koncentrator which it will then route traffic through (so its encrypted).