Encyrption domains / proxy ID

[Sharpierrr]

Hi,

I am new to setting up VPN tunnels from Palo Alto to a 3rd party firewall and I'm unsure how to setup the proxy IDs for the tunnel config. On the local side I have 9 x /32 addresses and on the remote side there are 7 x /25 subnet addresses. Do I need to setup a proxy ID for each individual transaction between local and remote subnets? That would be a lot of Proxy ID's and doesn't seem right, somehow?

[SutareMayur · Accepted solution]

@Sharpierrr,

Normally Proxy ID configuration should be identical with peer settings. This should match at both ends. If at peer end, separate subnets are defined as a encryption domain, and you're defining super netted subnet under Proxy ID then there will be mismatch  and this may result in connection failure.

So if you want to use Super netted subnet under Proxy IDs to avoid multiple entries, you need to have identical settings at peer end as well.

Hope it helps!

Mayur

[BK0007]

Yes, whatever you are planning to configure, at both ends it should be identical. I had faced issues due to mismatch in proxy Id configuration.

[Sharpierrr]

Thank you for your reply.