Configuring the Proxy-ID for phase 2 IPSec using PAN 6 CLI

[palomed]

there's this great example below for setting up an IPSec tunnel using the CLI. BUT it's missing how to add in the proxy IDs.

I have some clues that it's like..

set network tunnel ipsec IPSEC-Tuna-TUNNEL proxy-id tuna1 protocol any Local xxxx Remote yyyy

..but I'm just guessing. Can anyone supply me with the real mojo - perhaps from a cleaned working example?  TY

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-an-IPSEC-VPN-with-Route...

[bradk14 · Accepted solution]

performing my favorite trick of configuring in the GUI, then checking the config in the CLI in set mode, it looks like the following to me:

set network tunnel ipsec XXX auto-key proxy-id YYY protocol any
set network tunnel ipsec XXX auto-key proxy-id YYY local ZZZ/Z
set network tunnel ipsec XXX auto-key proxy-id YYY remote ZZZ/Z

but it looks like it can all be combined in a single line like you expressed.

set network tunnel ipsec XXX auto-key proxy-id YYY protocol any local ZZZ/Z remote ZZZ/Z

[palomed]

That's a big help. Thanks. Say - do you know what the auto-key term in the middle is about?

[TranceforLife]

Sorry for intrusion:

So better to keep it on auto.