Can firewall act as VPN client?

[Nick1]

Wondering if we can configure a lab PA-200 to connect to a VPN concentrator on the internet using IPsec, as though it were a VPN client not a site-to-site tunnel.  Not connecting to the firewall using GP, but using the firewall itself as the VPN client...and then use routing or tunnel interface to receive interesting traffic sent to firewall that would then be routed out the VPN tunnel by the firewall

[sraghunandan]

Please refer this document I think this is what you are looking for

https://live.paloaltonetworks.com/docs/DOC-4078

[sraghunandan]

And also https://live.paloaltonetworks.com/docs/DOC-4139

[Nick1]

I am wondering more along the lines of using the PA-200 as a VPN client to a non-Palo Alto VPN concentrator, like a Cisco ASA.  Say for instance big Company A's central office has an ASA but only allows IPsec client connections to it, will not allow site-to-site tunnels.  Then they purchase a new Company B with 15 employees in another town that has a PA-200 as their office firewall.  Rather than setting up AnyConnect VPN client on all 15 employee workstations in Company B to connect to Company A, could I configure Company B's PA-200 to establish the client VPN connectivity one-time centrally and then route all Company B's non-internet server RDP traffic to Company A's datacenter through the VPN tunnel

[sraghunandan · Accepted solution]

Hi Nick,

I don't think that's possible.the only way out is an ipsec site to site tunnel .

[JRussell]

I'm with sraghunadan here. I don't think it was ever intended to be used in that way, and trying to get it to work in this way would probably just waste your own time

[mikand]

I think the LSVPN setup will use the devices as "clients" but I think its more of a semantics thingy.

What actually happends is that the device setups a tunnel towards the koncentrator which it will then route traffic through (so its encrypted).