topic New site to site VPN creation with same proxy IDs in General Topics

New site to site VPN creation with same proxy IDs

mhamid — Fri, 04 May 2018 19:33:09 GMT

I have a HQ PAN connecting to a remote ASA and IPSec is up with static routes and proxy IDs. Have installed and configured a new PAN parallel to remote ASA which is going to be replacing it

Question is, can i have a new VPN configured in HQ to new remote PAN, where the proxy IDs will be same as the operational one? The remote IP for PAN is different from ASA. Also static route needs to be there for smooth migration

Thanks

Re: New site to site VPN creation with same proxy IDs

OtakarKlier — Fri, 04 May 2018 19:40:15 GMT

Hello,

The PAN's are route based VPN so you can bring up the tunnel without any proxy-id's and then when you are ready to migrate to the remote PAN, just change the routes to go down that tunnel instead. One thing I did when working with remote PAN's is allow the external interface be a management interface but only from my data center IP's. That way if something happened with the tunnel, I could still access the remote PAN.

Hope that helps.

Regards,

Re: New site to site VPN creation with same proxy IDs

mhamid — Fri, 04 May 2018 21:33:26 GMT

Thanks for the reply

i think i understand it now after your explanation and discussion at below link

https://live.paloaltonetworks.com/t5/Learning-Articles/Proxy-ID-for-VPNs-Between-Palo-Alto-Networks-and-Firewalls-with/ta-p/54859

PAN to PAN VPN doesnt need proxy ID, and traffic will only pass through VPN when i route to it...