IP Sec VPN Paloalto - Starlink

[CraigSmith2]

I'm testing Starlink business and having issues passing traffic over my tunnel. This remote site connects to our data center via an IPsec tunnel. I can get the tunnel up and traceroute to the remote side of the tunnel, but I'm unable to pass traffic. I have "Enable NAT Traversal" selected on my IKE Gateway. The Starlink is set to IP passthrough.

Any help would be appreciated.

[Raido_Rattameister]

If you can traceroute to other side over the tunnel it means that some traffic does cross the tunnel successfully right?

[CraigSmith2]

Yes, I agree, however, I'm unable to ping the management interface of the PA-220. Also from the remote side, I can't ping the gateway that is on the PA-220 for any of my vlans and my Cisco phones do not register. 

[Raido_Rattameister]

Both sides have Palo?

Do you have access to firewalls on both side?

[CraigSmith2]

Yes, both sides have Palo Altos. When I'm on-site I have access to both firewalls. I have to unplug the Starlink cable to keep my other tunnel running.

[Raido_Rattameister]

Check firewall policies on both sides if they permit traffic to/from tunnel zone.

Can you share screenshot of working and not working traffic log from both sides and have at least those columns visible.

[CraigSmith2]

Thank you for your response. Both sides have policies that permit traffic to/from the tunnel zone. I have another circuit that works with no issues at this site. However, when getting the screenshots you requested I noticed that on Starlink most of the traffic goes Interzone-default policy and is denied.

[OtakarKlier]

Hello,

Do you have policies in place to allow the traffic to flow via the tunnel? Also how is the 'default', 0.0.0.0/0 route getting advertised on the 'remote' side, or is it a static route?

Regards,

[OtakarKlier · Accepted solution]

Hello,

Sorry I didnt see the traffic screen shots before. But it looks like there are missing policies so the traffic is hitting the 'default' policies.

Regards,

[ChrisThornton]

I'm having the same problem. It dosn't happen all the time. I think it has to do with esp traffic being blocked 

[Pollack32]

Is there any solution.?

[OtakarKlier]

Hello,

For the policy that handles the VPN traffic, do not perform and inspections or ssl decryption, etc. Basically allow all traffic to/from the two IP's that are the VPN endpoints and see how that works out. My guess is that there is UDP traffic getting blocked/dropped.

Regards,

[CraigSmith2]

Sorry for not responding. I abandoned this project.

Yes the routes are static and looking back at my screenshots I think you are correct that policies were missing. 

I'm considering trying StarLink again, I was reviewing what went wrong. Thank you for your help.

[dkaliel]

We had the same issue and StarLink confirmed the following so we are looking into a solution

ESP packets are dropped.

VPNs that rely on protocols 47 (GRE), 50 (ESP), 51 (AH), 115 (L2TP) are dropped by CGNAT at this time.

[PktBlocker]

Just going to chime in for folks like myself who have limited choices. I found a good article on a competitor site that helped me and i managed to get a site to site up thru starlink residential.

my setup is PA-->FTG-->Starlink--->ISP--->PA Corp. 

PA on Corp side is in passive mode since it has the static ip

Both PAs are running ikev1 in aggressive mode with NAT-T

The FTG in my case is just acting like a service provider

https://community.fortinet.com/t5/Support-Forum/IPSEC-tunnels-behind-CGNAT-Starlink/m-p/226976

https://www.starlink.com/support/article/aa5aecf3-e97c-e84e-3f87-8d2ecdfde857

I am a bit curious if anyone has run any testing to see if any of the ports are blocked per the article from starlink below? I would think the traffic thru the vpn would be immune to this.

https://www.starlink.com/support/article/c3caacdf-1c1f-98db-b821-bbb36ca9d89b