i'm going to go with "no"
When you configure an ipsec tunnel, you define what the connection between a local ike gateway and a remote ike gateway will look like (local and remote gateways are configured in the ike object, the connection between the two is configured in the ipsec object)
It's like the network cable that connects a local ethernet port to a remote ethernet port. if you need to connect to another port, you will need another cable
Proxy IDs aren't required for an IPSec tunnel. At least not for a route based tunnel - even if there technically the proxy ID 0.0.0.0/0 on both sides is used (thats what paloalto uses if you do not specify proxy IDs). On a paloalto firewall an IPSec tunnel never is policy based as you have to use the routing table to specify what the firewall sends into the tunnel but the proxy IDs are used to configure tunnels to other VPN gateways that only support policy based tunnels or use policy based tunnels for whatever reason.
It depends on the other VPN device. If its two PAN's then they are not required, if its a PAN and ASA, yes. PAN's VPN is route based and other manufactures are zone based.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!