topic Re: Configure IPSec between Palo Alto devices in General Topics

Configure IPSec between Palo Alto devices

ZEBIT — Mon, 05 Mar 2018 10:07:29 GMT

We have two vpn Palo Alto devices.

One in our HQ departement and one in a remote location.

I need to setup an IPSec VPN tunnel between these sites with the Palo Alto devices but I never did this before.

On the Palo Alto website I found this article which was helpfull https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-IPSec-VPN/ta-p/56535 but the devices does not connect with each other.

Also for our remote location I only want that the traffic to our servers go into the tunnel but internet traffic does not.

Second how can I configure to which server the clients of the remote sites can access?

I need to get al this to work on Wednesday.

theonewhoknocks — Mon, 05 Mar 2018 10:19:23 GMT

Hi Zebit,

What's the status of the VPN tunnel? Has it passed phase1-IKE? Can you ping the public IP of the remote site from the HQ firewall? and vice versa?

You can look on this article to have a basic troubleshooting on which part of your VPN setup is not working.

https://live.paloaltonetworks.com/t5/Featured-Articles/DotW-VPN-IPSec-Tunnel-Status-is-Red/ta-p/79224

ZEBIT — Mon, 05 Mar 2018 10:24:09 GMT

The status of the tunnel and IKE is red.

theonewhoknocks — Mon, 05 Mar 2018 10:33:13 GMT

This article is a detailed troubleshooting on a VPN setup. It helped me solve most of my VPN issues. Check it, it may help you.

ZEBIT — Mon, 05 Mar 2018 14:52:45 GMT

I found the solution. It is something stupid.

I forgot to create policy rules which allows a connection from zone EXTERN to zone EXTERN with the application ipsec and ike.