2 IKE gateways and 1 IPsec tunnel

Reply
Highlighted
L4 Transporter

2 IKE gateways and 1 IPsec tunnel

Can you have 2 IKE gateways connect to  1 IPsec tunnel?

Highlighted
Cyber Elite

Hello,

Are you referring to IPSec tunnels or Tunnel interfaces?

 

Just curious.

Highlighted
L7 Applicator

i'm going to go with "no"

 

When you configure an ipsec tunnel, you define what the connection between a local ike gateway and a remote ike gateway will look like (local and remote gateways are configured in the ike object, the connection between the two is configured in the ipsec object)

 

It's like the network cable that connects a local ethernet port to a remote ethernet port. if you need to connect to another port, you will need another cable

Tom Piens - PANgurus.com
Find my book at amazon.com/dp/1789956374
Highlighted
L4 Transporter

@reaper @OtakarKlier

No was the answer I was expecting but the cloud company that we are doing a trial with suggested it but I didn't see how it would be possible

Highlighted
L4 Transporter

@OtakarKlier

The ipsec tunnel

Highlighted
L1 Bithead

Hi,

 

This is not possible because two different gateways have different proxy IDs which will fail the phase 2 negotiation.

 

Highlighted
L4 Transporter

@Dali_Chauhan @reaper @OtakarKlier

So are the proxy IDs a requirement i didn't think they were

Highlighted
Cyber Elite

Proxy IDs aren't required for an IPSec tunnel. At least not for a route based tunnel - even if there technically the proxy ID 0.0.0.0/0 on both sides is used (thats what paloalto uses if you do not specify proxy IDs). On a paloalto firewall an IPSec tunnel never is policy based as you have to use the routing table to specify what the firewall sends into the tunnel but the proxy IDs are used to configure tunnels to other VPN gateways that only support policy based tunnels or use policy based tunnels for whatever reason.

Highlighted
Cyber Elite

Hello,

It depends on the other VPN device. If its two PAN's then they are not required, if its a PAN and ASA, yes. PAN's VPN is route based and other manufactures are zone based.

 

Regards,

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!