PA support SVTI

Venkatesan_radhakrishnan — Tue, 19 Mar 2019 10:06:33 GMT

Do palo alto support SVTI like Cisco.

SVTI configurations can be used for site-to-site connectivity in which a tunnel provides always-on access between two sites. The advantage of using SVTIs as opposed to crypto map configurations is that users can enable dynamic routing protocols on the tunnel interface without the extra 4 bytes required for GRE headers, thus reducing the bandwidth for sending encrypted data.

https://networklessons.com/cisco/ccie-routing-switching-written/ipsec-static-virtual-tunnel-interface

Regards

Venky

Re: PA support SVTI

reaper — Tue, 19 Mar 2019 11:28:43 GMT

Hi @Venkatesan_radhakrishnan

What you describe is the transition for Cisco from GRE based tunnels to IPSec based tunnels (this happened somewhere around 2004)

Our default VPN is IPSec based and uses virtual tunnel interfaces

In PAN-OS 9.0 we added GRE support to be backward compatible to pre-ipsec devices 😉

topic PA support SVTI in General Topics

PA support SVTI

Re: PA support SVTI