2 IKE gateways and 1 IPsec tunnel

[jdprovine]

Can you have 2 IKE gateways connect to  1 IPsec tunnel?

[OtakarKlier]

Hello,

Are you referring to IPSec tunnels or Tunnel interfaces?

Just curious.

[reaper]

i'm going to go with "no"

When you configure an ipsec tunnel, you define what the connection between a local ike gateway and a remote ike gateway will look like (local and remote gateways are configured in the ike object, the connection between the two is configured in the ipsec object)

It's like the network cable that connects a local ethernet port to a remote ethernet port. if you need to connect to another port, you will need another cable

[jdprovine]

@reaper @OtakarKlier

No was the answer I was expecting but the cloud company that we are doing a trial with suggested it but I didn't see how it would be possible

[jdprovine]

@OtakarKlier

The ipsec tunnel

[Dali_Chauhan]

Hi,

This is not possible because two different gateways have different proxy IDs which will fail the phase 2 negotiation.

[jdprovine]

@Dali_Chauhan @reaper @OtakarKlier

So are the proxy IDs a requirement i didn't think they were

[Remo]

Proxy IDs aren't required for an IPSec tunnel. At least not for a route based tunnel - even if there technically the proxy ID 0.0.0.0/0 on both sides is used (thats what paloalto uses if you do not specify proxy IDs). On a paloalto firewall an IPSec tunnel never is policy based as you have to use the routing table to specify what the firewall sends into the tunnel but the proxy IDs are used to configure tunnels to other VPN gateways that only support policy based tunnels or use policy based tunnels for whatever reason.

[OtakarKlier]

Hello,

It depends on the other VPN device. If its two PAN's then they are not required, if its a PAN and ASA, yes. PAN's VPN is route based and other manufactures are zone based.

Regards,