topic Re: Routing traffic from branch through HQ to vendor in General Topics

Routing traffic from branch through HQ to vendor

k.truex — Thu, 27 Sep 2018 16:37:11 GMT

Currently Im labing a situtation where I'll need to have branch users route to a vendor through HQ via IPsec tunnels. Users at my banch access can acesss Web/HQ services though the HQ firewall, but when accessing the vendor. Logs show from HQ the attempts to the vendor from the branch office. But nothing but incompletes/aged-out.

From HQ, I do see active connections for phaseII for the branch/vendor connection but of course no encap/decaps.

Also I do have redistrabution profiles for Branch and Vendor connections on the HQ firewall.

Thoughts?

Re: Routing traffic from branch through HQ to vendor

k.truex — Thu, 27 Sep 2018 16:50:30 GMT

Just found this, which Im spot on. I do worry that my vendor side might be incorrect

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-To-Connect-2-Branch-Locations-to-Connect-through-HQ-Site/ta-p/62643

Re: Routing traffic from branch through HQ to vendor

k.truex — Fri, 05 Oct 2018 17:09:43 GMT

So found I the problem, or "more of a design issue".

The dynamic vpn setup on my branch side, is the issue to the vendor. I relized that when settting up a direct connection from branch to vendor. The vendor does not support Nat-T!!!! Doh!!!! Which is why I would see the out bound encaps but no decaps back on the HQ side.

Back to the drawing board... Hopefully this stops someone form spinning their wheels