How to Configure IPSec VPN Tunnel when a peer is behind a router without a static public IP

[Iandrea]

Environment
PaloAlto Next-Gen Firewall
IPSec VPN Tunnel
Topology
PA1 ----- Router ----- PA2

Public IP of PA1 : 10.50.50.50
Public IP of Router : Dynamic IP
Internal IP of Router : 10.20.20.1
Private IP of PA2 : 10.20.20.20

PA2 Private IP is natted by Router with Dynamic IP of Router itself

10.20.20.1 is the Default Gateway of PA2.

This is my IKE Gateway configuration on PA1

Local IP Address: 10.50.50.50

Peer Type: Dynamic

Preshared Key: abcd123

Peer Identification: test@my.lab

Enable Passive mode

Enable NAT Traversal

This is my IKE Gateway configuration on PA2

Local IP Address: None

Peer IP Address: 10.50.50.50

Preshared Key: abcd123

Local Identification: test@my.lab

Enable NAT Traversal

Proxy IDs configurations on PA1

local: 192.168.50.0/24 - remote: 192.168.20.0/24 (any protocol)

Proxy IDs configurations on PA2

local: 192.168.20.0/24 - remote: 192.168.50.0/24 (any protocol)

192.168.20.0/24 is NATTED on PA2 with IP 10.20.20.30

With this configuration the tunnel cant' go up.

What is wrong? What I missed up?

Thanks a lot

Andrea

[JayGolf]

Hi @Iandrea ,

Here is a helpful KB on troubleshooting IPSec VPN connectivity issues.