Palo Alto - GPVPN - IPSEC b2b

Reply
Highlighted
L0 Member

Palo Alto - GPVPN - IPSEC b2b

My current role is as a Network Architect and I am working with our security team to get some Palo Alto firewalls setup to provide

GPVPN access and also IPSEC b2b connectivity.

 

Our initial design has a single external public address to host the GPVPN traffic and the IPSEC b2b traffic and works ok. We are currently discussing the option of implementing a 2nd public address so that we can split the GPVPN and IPSEC b2b traffic on to separate interfaces which seems to make sense.

 

We are also hearing from the security department that they would like to see each IPSEC b2b tunnel terminated on an individual public IP address which we are going to discuss.

 

What are your thoughts on this

 

Option 1 -  Stay with a single public IP to terminate GPVPN and b2b IPSEC tunnels

 

Option 2-   Have a Public IP for GPVPN and a 2nd Public IP's for "ALL" b2b IPSEC tunnels

 

Option 3 - Have a Public IP for GPVPN and multiple Public IP's - 1 for each IPSEC tunnel

          20 tunnels - 20 public IP's      50 tunnels - 50 public IP's

 

I am expecting a lot of people to come back with either option 1 or option 2 but I am interested to see if anyone

thinks option 3 is a good idea.

Tags (3)
L4 Transporter

Re: Palo Alto - GPVPN - IPSEC b2b

Howdy

 

Option 2 is what you should be using.

 

Option 3 is definitely not needed.  Having unique public IP does not provide additional security, only additional option for potential misconfiguration and challenging troubleshooting.

 

I would be using public IP with loopback addresses vs exposing the true public IP associated with your 2 ethernet interfaces.

 

 

L4 Transporter

Re: Palo Alto - GPVPN - IPSEC b2b

Hi@SteveCantwell and what will be the benefit of option 2?

 

@mcroninI would personally go for option 1:

- The other two options bring unnecessary complexity. One public IP for site-to-site and RA VPN is simple and easy to support

- If you enable GP VPN on the same interface that you use for site-to-site or on a separate, you still need to expose it and open the required ports. If it reachable from internet any scanner will detect it and will try to exploit.

L7 Applicator

Re: Palo Alto - GPVPN - IPSEC b2b

Hello,

I would say Option 1 or 2. Both have advantages and disadvantages. I would say make sure that whatever the internal to external NAT should be different just in case a VPN user does something goofy and get that IP blocked some how it wont affect other services.

 

Cheers!

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!