topic Re: 2 IKE gateways and 1 IPsec tunnel in General Topics

2 IKE gateways and 1 IPsec tunnel

jdprovine — Fri, 19 Oct 2018 18:21:47 GMT

Can you have 2 IKE gateways connect to 1 IPsec tunnel?

Re: 2 IKE gateways and 1 IPsec tunnel

OtakarKlier — Fri, 19 Oct 2018 18:46:01 GMT

Hello,

Are you referring to IPSec tunnels or Tunnel interfaces?

Just curious.

Re: 2 IKE gateways and 1 IPsec tunnel

reaper — Fri, 19 Oct 2018 21:42:23 GMT

i'm going to go with "no"

When you configure an ipsec tunnel, you define what the connection between a local ike gateway and a remote ike gateway will look like (local and remote gateways are configured in the ike object, the connection between the two is configured in the ipsec object)

It's like the network cable that connects a local ethernet port to a remote ethernet port. if you need to connect to another port, you will need another cable

Re: 2 IKE gateways and 1 IPsec tunnel

jdprovine — Mon, 22 Oct 2018 12:53:04 GMT

@reaper @OtakarKlier

No was the answer I was expecting but the cloud company that we are doing a trial with suggested it but I didn't see how it would be possible

Re: 2 IKE gateways and 1 IPsec tunnel

jdprovine — Mon, 22 Oct 2018 12:53:46 GMT

@OtakarKlier

The ipsec tunnel

Re: 2 IKE gateways and 1 IPsec tunnel

Dali_Chauhan — Tue, 23 Oct 2018 11:58:12 GMT

Hi,

This is not possible because two different gateways have different proxy IDs which will fail the phase 2 negotiation.

Re: 2 IKE gateways and 1 IPsec tunnel

jdprovine — Wed, 24 Oct 2018 12:09:18 GMT

@Dali_Chauhan @reaper @OtakarKlier

So are the proxy IDs a requirement i didn't think they were

Re: 2 IKE gateways and 1 IPsec tunnel

Remo — Wed, 24 Oct 2018 16:36:39 GMT

Proxy IDs aren't required for an IPSec tunnel. At least not for a route based tunnel - even if there technically the proxy ID 0.0.0.0/0 on both sides is used (thats what paloalto uses if you do not specify proxy IDs). On a paloalto firewall an IPSec tunnel never is policy based as you have to use the routing table to specify what the firewall sends into the tunnel but the proxy IDs are used to configure tunnels to other VPN gateways that only support policy based tunnels or use policy based tunnels for whatever reason.

Re: 2 IKE gateways and 1 IPsec tunnel

OtakarKlier — Wed, 24 Oct 2018 16:37:39 GMT

Hello,

It depends on the other VPN device. If its two PAN's then they are not required, if its a PAN and ASA, yes. PAN's VPN is route based and other manufactures are zone based.

Regards,