My current role is as a Network Architect and I am working with our security team to get some Palo Alto firewalls setup to provide
GPVPN access and also IPSEC b2b connectivity.
Our initial design has a single external public address to host the GPVPN traffic and the IPSEC b2b traffic and works ok. We are currently discussing the option of implementing a 2nd public address so that we can split the GPVPN and IPSEC b2b traffic on to separate interfaces which seems to make sense.
We are also hearing from the security department that they would like to see each IPSEC b2b tunnel terminated on an individual public IP address which we are going to discuss.
What are your thoughts on this
Option 1 - Stay with a single public IP to terminate GPVPN and b2b IPSEC tunnels
Option 2- Have a Public IP for GPVPN and a 2nd Public IP's for "ALL" b2b IPSEC tunnels
Option 3 - Have a Public IP for GPVPN and multiple Public IP's - 1 for each IPSEC tunnel
20 tunnels - 20 public IP's 50 tunnels - 50 public IP's
I am expecting a lot of people to come back with either option 1 or option 2 but I am interested to see if anyone
thinks option 3 is a good idea.
Option 2 is what you should be using.
Option 3 is definitely not needed. Having unique public IP does not provide additional security, only additional option for potential misconfiguration and challenging troubleshooting.
I would be using public IP with loopback addresses vs exposing the true public IP associated with your 2 ethernet interfaces.
Hi@SteveCantwell and what will be the benefit of option 2?
@mcroninI would personally go for option 1:
- The other two options bring unnecessary complexity. One public IP for site-to-site and RA VPN is simple and easy to support
- If you enable GP VPN on the same interface that you use for site-to-site or on a separate, you still need to expose it and open the required ports. If it reachable from internet any scanner will detect it and will try to exploit.
I would say Option 1 or 2. Both have advantages and disadvantages. I would say make sure that whatever the internal to external NAT should be different just in case a VPN user does something goofy and get that IP blocked some how it wont affect other services.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!