2 IKE gateways and 1 IPsec tunnel

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

2 IKE gateways and 1 IPsec tunnel

L4 Transporter

Can you have 2 IKE gateways connect to  1 IPsec tunnel?

8 REPLIES 8

Cyber Elite
Cyber Elite

Hello,

Are you referring to IPSec tunnels or Tunnel interfaces?

 

Just curious.

Cyber Elite
Cyber Elite

i'm going to go with "no"

 

When you configure an ipsec tunnel, you define what the connection between a local ike gateway and a remote ike gateway will look like (local and remote gateways are configured in the ike object, the connection between the two is configured in the ipsec object)

 

It's like the network cable that connects a local ethernet port to a remote ethernet port. if you need to connect to another port, you will need another cable

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

@reaper @OtakarKlier

No was the answer I was expecting but the cloud company that we are doing a trial with suggested it but I didn't see how it would be possible

@OtakarKlier

The ipsec tunnel

L1 Bithead

Hi,

 

This is not possible because two different gateways have different proxy IDs which will fail the phase 2 negotiation.

 

@Dali_Chauhan @reaper @OtakarKlier

So are the proxy IDs a requirement i didn't think they were

Proxy IDs aren't required for an IPSec tunnel. At least not for a route based tunnel - even if there technically the proxy ID 0.0.0.0/0 on both sides is used (thats what paloalto uses if you do not specify proxy IDs). On a paloalto firewall an IPSec tunnel never is policy based as you have to use the routing table to specify what the firewall sends into the tunnel but the proxy IDs are used to configure tunnels to other VPN gateways that only support policy based tunnels or use policy based tunnels for whatever reason.

Hello,

It depends on the other VPN device. If its two PAN's then they are not required, if its a PAN and ASA, yes. PAN's VPN is route based and other manufactures are zone based.

 

Regards,

  • 2858 Views
  • 8 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!