topic Re: IPsec question in General Topics

IPsec question

Nick.Spender — Fri, 28 Sep 2018 00:34:21 GMT

Hello

I have many IPsec connectios on my PA. But their are 2 that both use 192.168.100.x

Now IPsec A is policy based. So I have configured the proxy ID's. All working fine. Now I have narrowed the routes down to the 2 host I require. Which are 192.168.100.32/32 and .33/32 , IPsec B is a tunnel / route based IPsec. I've added the routes in which are 192.168.100.250/32 and .251/32. Should this be a problem? Also a side note can you have 2 IPsec connections which are policy base (proxy ID's) so they have the same proxy ID's but different routes i.e like I have above

Thanks Nick 🙂

Re: IPsec question

OtakarKlier — Fri, 28 Sep 2018 14:19:59 GMT

Hello Nick,

Sounds like you have overlapping subnets. There is a PAN solution for this. Check out the following article:

https://www.paloaltonetworks.com/documentation/10/cloud-services/globalprotect-cloud-service-gsg/gpcs-quick-configs/remote-network-locations-with-overlapping-subnets

Regards,

Re: IPsec question

Nick.Spender — Fri, 28 Sep 2018 14:26:39 GMT

But thats the question do i have overlapping subnets as the routes i have for the IPsec's are as followed

IPSec A

192.168.100.250/32

192.168.100.251/32

IPSec B

192.168.100.32/32

192.168.100.33/32

So the IP addresses are not actaully overlapping as i am refereancing them as /32's

is this correct?

Re: IPsec question

OtakarKlier — Fri, 28 Sep 2018 14:30:32 GMT

Hello,

Sorry I misunderstood the question. This should be OK if you have the routes setup in your virtual router the same way. The PAN would then know where to send the packets.

Regards,