topic Múltiple Proxy ID PAN - Migration from FG using group address. in General Topics

Múltiple Proxy ID PAN - Migration from FG using group address.

MauricioPerez — Wed, 23 Dec 2020 15:37:11 GMT

Hello guys!

I'm on a manual STS VPN homologation from fortigate, and I have address pools declared in the encryption domains, which translates to too many proxy id's for palo alto, is there any way to configure this without having to generate so many proxy id? I know you can't use groups, but can you do something with variables or any ideas?

Thank you!

Re: Múltiple Proxy ID PAN - Migration from FG using group address.

reaper — Thu, 24 Dec 2020 11:00:13 GMT

is there a way for you to replace the pools with actual subnets?

the Palo Alto firewalls doesn't need Proxy-IDs to function, only if the remote end requires these should they be set up

subnets are the more common practice when adding Proxy-IDs (for each unique ID pair, both devices need to create a Security Association, so for a subnet you only need 1 set, but for 1:1 you would need hundreds of SAs the firewalls need to maintain)