Need help on VPN PA firewall to IBM cloud VPN

L0 Member

Need help on VPN PA firewall to IBM cloud VPN



I am new to Palo Alto World


Really need your Help in understanding how can i create the VPN for the below


1. IBM cloud subnet only 1 subnet so thats okay. 

2. Multiple subnets behind my PA firewall, my question is how to NAT them all to go out?


IBM just confirmed that they are using ROUTE based VPN , so i believe i do not need to define proxy IDs?


Customer at my end says you can NAT all our internal traffic . they have given me a private IP subnet to nat the traffic over the  VPN however they also need some hosts to hosts bidirectional communication .


Please suggest how to setup this VPN.

Community Manager

Re: Need help on VPN PA firewall to IBM cloud VPN

please take a look at this article, it is similar and maty be helpful: DotW: Help with IPSec Proxy IDs with overlapping IPs


Since they are route based, this will simplify your config somewhat (you dont need proxy IDs)


on your end you'll need to set a couple of policies :


for the bidirectional IP's i'd recommend creating individual back and forth policies, this makes it a little more clear which policies are used:


vpn nat.png

Help the community: Like helpful comments and mark solutions
Reaper out
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!