VPN Tunnel Monitoring between two Palo Alto devices

NobleNOC — Thu, 12 Nov 2020 18:28:24 GMT

Hello,

From what I understand, when creating a tunnel monitor between two PA devices it's best to assign IP addresses on the same segment to the tunnel interface on each side. The monitor is then setup with the remote destination on each side.

Example:

FW-A-Tunnel.1 (10.10.10.1/30) <---> FW-B-Tunnel.1 (10.10.10.2/30)

FW-A will monitor 10.10.10.2

FW-B will monitor 10.10.10.1

On the firewall this creates what appears to be a directly connected network on the tunnel interfaces, and no additional configuration or routing is required. I have set it up this way and it works, but I just want to make sure I'm understanding it correctly, and doing it properly. There isn't much documentation on the IP configuration, but it seems like an arbitrary private address on the same network on both sides is the solution.

Thanks.

Re: VPN Tunnel Monitoring between two Palo Alto devices

OtakarKlier — Thu, 12 Nov 2020 22:35:39 GMT

Hello,

Sounds like you have it correct :).

Cheers!

topic Re: VPN Tunnel Monitoring between two Palo Alto devices in General Topics

VPN Tunnel Monitoring between two Palo Alto devices

Re: VPN Tunnel Monitoring between two Palo Alto devices