topic Re: Limitations for creating number of child sa for site to site vpn in General Topics

Limitations for creating number of child sa for site to site vpn

veerrohitparihar2 — Thu, 11 Jun 2020 08:24:00 GMT

Hi,

Here I am trying to create a site to site vpn in Paloalto firewall, now in local network I have 8 individual /32 ips and for remote 10 individual /32 ips. This is for policy based vpn. Now if I add proxy ids for local and remote ips. I am getting around 80 proxy ids. Requirement is to only use ips not subnets. Now few connections are not working though it is allowed and phase 2 is up. I want to confirm if there is any limitations in creating total numbers of proxy ids and if it creates any impact in performance of the firewall?

Re: Limitations for creating number of child sa for site to site vpn

reaper — Thu, 11 Jun 2020 13:28:31 GMT

proxy id's are essentially individual vpn tunnels, so you're setting up 80 vpn tunnels

what kind of platform are you stting this up on?

Re: Limitations for creating number of child sa for site to site vpn

veerrohitparihar2 — Thu, 11 Jun 2020 18:49:33 GMT

We are creating a single site to site vpn between PA-220 and FTD firewall and within that multiple /32 ips needs to communicate

Re: Limitations for creating number of child sa for site to site vpn

OtakarKlier — Mon, 15 Jun 2020 21:56:29 GMT

Hello,

See if the IP's can fit into a subnet. Also you can just create one proxy id, all the ip's/subnets and then use policies to limit the traffic.

Just some thoughts.

Re: Limitations for creating number of child sa for site to site vpn

BPry — Tue, 16 Jun 2020 02:46:42 GMT

@veerrohitparihar2,

Correct, but as @reaper mentioned in his previous comment any time you add a proxy id you are essentially adding another tunnel. So as far as your firewall is concerned it's going to create what amounts to 80 tunnels to support all of the Proxy IDs you are trying to configure.

Re: Limitations for creating number of child sa for site to site vpn

veerrohitparihar2 — Sat, 20 Jun 2020 06:06:10 GMT

I just found my answer in the PaloAlto PSNSE Study guide, under Topic Tunnel interface. " Tunnel interface can have a maximum of 250 proxy IDs. Each proxy ID counts toward the IPsec VPN tunnel capacity of the firewall, and the tunnel capacity varies by the firewall model. "