Do I configure proxy-id in ipsec-vpn certainly?

[KiCheon.Lee]

Hello all,

What is proxy-id in ipsec-vpn configuration??

Why does it need??

I will use ipsec-vpn on PA-2020 & PA-500.

Each devices have 15 proxy-id(remote-networks).

I know one tunnel interface has 10 proxy-ids.

So I have tested without proxy-id that traffics are processed routing-table(next-hop tunnel interface) to 15 remote-networks.

It is normal. Do I configure proxy-id in ipsec-vpn certainly??

What problem does it has if I configure ipsec-vpn without proxy-id???

Or please let me know if you know other good way.

Thanks.

[UhMayYeah · Accepted solution]

What is proxy-id in ipsec-vpn configuration??Why does it need??

• A proxy-IDs  are negotiated during  Phase II tunnel establishment and define the Traffic that needs to be Encrypted or the Interested Traffic for an IPSEC tunnel.
• Policy Based VPN define this using a combination of SRC IP, DST  IP, and SERVICES  in a tunnel policy. (Eg : Security Rules in Juniper for Policy Based VPNs or ACLs in Cisco).
• Route Based VPN use a logical L3  tunnel interface ,traffic destined for the Tunnel is Encrypted and use 0.0.0.0/0 as Proxy IDs by default.

PA firewalls use Route Based approach hence Proxy-IDs are manually configured  On PA firewalls only while connecting with Policy Based VPNs to match the ones configured on the Peer.

Terminology

(ACL :: CISCO   ||     PROXY IDs :: Juniper     ||     Encryption Domains :: CHKPOINT)

So the behavior observed is NORMAL and You do not need to configure Proxy IDs for Establishing IPSEC between  PA firewalls.

[KiCheon.Lee]

Wow, Thanks a million for your detail answer.

Must not between PA devices be configured proxy-ids?

And must PA device be configured proxy-id when connect policy based vpn such as Cisco , Juniper , CHKPOINT by ipsec-vpn????

Is it right???

[UhMayYeah]

Yes thts Right.

No Proxy Ids between 2 PA s

But only for Policy Based VPN using Peer ,in short for Cross Vendor VPNs

Ameya

[KiCheon.Lee]

Thank you very much, Ameya.

I am helpful for you answer.