topic Re: Encyrption domains / proxy ID in General Topics

Encyrption domains / proxy ID

Sharpierrr — Tue, 19 May 2020 20:38:13 GMT

Hi,

I am new to setting up VPN tunnels from Palo Alto to a 3rd party firewall and I'm unsure how to setup the proxy IDs for the tunnel config. On the local side I have 9 x /32 addresses and on the remote side there are 7 x /25 subnet addresses. Do I need to setup a proxy ID for each individual transaction between local and remote subnets? That would be a lot of Proxy ID's and doesn't seem right, somehow?

Re: Encyrption domains / proxy ID

SutareMayur — Wed, 20 May 2020 04:02:36 GMT

@Sharpierrr,

Normally Proxy ID configuration should be identical with peer settings. This should match at both ends. If at peer end, separate subnets are defined as a encryption domain, and you're defining super netted subnet under Proxy ID then there will be mismatch and this may result in connection failure.

So if you want to use Super netted subnet under Proxy IDs to avoid multiple entries, you need to have identical settings at peer end as well.

Hope it helps!

Mayur

Re: Encyrption domains / proxy ID

BK0007 — Wed, 20 May 2020 04:15:26 GMT

Yes, whatever you are planning to configure, at both ends it should be identical. I had faced issues due to mismatch in proxy Id configuration.

Re: Encyrption domains / proxy ID

Sharpierrr — Wed, 20 May 2020 07:55:31 GMT

Thank you for your reply.