Forgive the newbie question, but I've been searching the documentation and I don't see where I can configure the Paloalto FW for vpn passthrough, specifically ESP (Protocol 50) and even ICMP. I have some routers that I need to provide NAT for their external address, but I also want to limit the services available on the Internet to just PING reply, ESP, IKE and NAT-T. I've added UDP service definitions for IKE and NAT-T, but I don't see anything for the others. Can someone point me in the right direction?
Allowing ipsec application in your security policy will allow your PAN device to act as vpn passthrough.
ipsec application is containing sub-app: ike,ipsec-ah,ipsec-esp,ipsec-esp-udp(NAT-T) implicitly allowed.
To allow only icmp-ping, use ping application in your policy.
Hope this will help.
Applications like Ping and ESP, do not have port numbers and have their own protocol numbers. When the PANFW receives these packets, and if there is a NAT rule applied to perform both address and port translation, the PANFW drops these ESP packets ( because there is no port information in the ESP header. Also note that the PANFW drops these packets only if it is configured to perform address and port translation. If configured to translate just the addresses, like when using static NAT, the PANFW wont drop the packets ).
If you want the PANFW to NAT the ESP packets, ensure that you have NAT Traversal configured on the end routers. With NAT-T configured, the routers encapsulate the ESP payload into a UDP PDU, which carries this information on port 4500. When the PANFW receives this packet, it can translate the port number and hence wont drop the ESP packets.
Hope that helps.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!