PAN devices don't support Cisco's proprietary Dynamic Multipoint VPN or Easy VPN. You can configure the PAN to create tunnels with third party security devices, however. Connections between the central site and multiple remote sites would require VPN tunnels for each central-remote site pair and configuration of appropriate policies, DH parameters and encryption algorithms.
But If I want to test Dynamic VPN with 2 PaloAlto appliance, can I?
I have 2 line Internet:
-IP Public: 22.214.171.124 (dynamic IP)
-Modem's IP: 172.16.1.254/24
-PaloAlto1 Layer 3: Zone-Internet: 172.16.1.120/24
-Modem NAT port 1723 to IP 172.16.1.120
+Line 2: 126.96.36.199 (static IP)
-Modem's IP: 192.168.81.254/24
-PaloAlto2 Layer 3: Zone-Internet: 192.168.81.98/24
-Modem NAT port 1723 to IP 192.168.81.98
Both 2 PaloAlto, I configured IKE Gateway to point direct 2 IP public (still not use Dynamic option) but when I SSH to PaloAlto, and type 'show vpn flow' the state is init (not inactive) (please refer the attached file: Snapshot VPN-SSH.jpg).
I want to test Dynamic VPN, but I want to ensure that IPSec VPN running well first.
I uploaded some snapshots and the configuration file, please refer the attached files and help to solve this problem.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!