How to configure a IPSEC VPN proxy-id to allow Internet bound traffic?

Reply
Highlighted
L4 Transporter

How to configure a IPSEC VPN proxy-id to allow Internet bound traffic?

I have a S-to-S vpn tunnel to a remote location (terminating on cisco router) which was passing just the Intranet traffic. But, I would like to pass the site's Internet bound traffic through the VPN tunnel and subject it to Palo's threat inspection policies.How can I do this?

 

Thanks.

 


Accepted Solutions
Highlighted
Cyber Elite

Howdy

 

Yes, you should really have a simplified routing table (if I understand your query)

 

From the Cisco side.

One route to the PAN FW public IP (for establishing the VPN).

One (default route) to the PANW, via a tunnel interface, so that all traffic is encapsulated/transmited to the PANW FW for inspection.

 

Now 100% of all traffic goes across Cisco to PAN VPN for inspection.

Help the community: Like helpful comments and mark solutions

View solution in original post


All Replies
Highlighted
Cyber Elite

Hello there.

 

The will be changed by use of the routing table (generally speaking)

 

 

Routing Table (example)

ToPAN_as_PeerID (199.99.88.88) use Internet route

0.0.0.0 use tunnel interface.

 

Now, the FW will establish the Phase1 portion of the VPN to the Peer.

And Phase2 traffic will now be passed through the tunnel interface.

 

Thanks

 

Help the community: Like helpful comments and mark solutions
Highlighted
L4 Transporter

@SteveCantwell  I'm not quite sure I got your point. Are you suggesting me to put in a route pointing to tunnel interface on the peer side?  The peer is cisco router.

Highlighted
Cyber Elite

Howdy

 

Yes, you should really have a simplified routing table (if I understand your query)

 

From the Cisco side.

One route to the PAN FW public IP (for establishing the VPN).

One (default route) to the PANW, via a tunnel interface, so that all traffic is encapsulated/transmited to the PANW FW for inspection.

 

Now 100% of all traffic goes across Cisco to PAN VPN for inspection.

Help the community: Like helpful comments and mark solutions

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!