IPSEC Pass Through

[jpvh1234]

Forgive the newbie question, but I've been searching the documentation and I don't see where I can configure the Paloalto FW for vpn passthrough, specifically ESP (Protocol 50) and even ICMP.  I have some routers that I need to provide NAT for their external address, but I also want to limit the services available on the Internet to just PING reply, ESP, IKE and NAT-T.  I've added UDP service definitions for IKE and NAT-T, but I don't see anything for the others.  Can someone point me in the right direction?

[nbilly]

Hello Jeff,

Allowing ipsec application in your security policy will allow your PAN device to act as vpn passthrough.

ipsec application is containing sub-app: ike,ipsec-ah,ipsec-esp,ipsec-esp-udp(NAT-T) implicitly allowed.

To allow only icmp-ping, use ping application in your policy.

Hope this will help.

Regards

-Nicolas

[Amnuay]

Hi nbilly,

Any possibility on services object to be configured? Because on NAT Policy I can't configure application. Just want to NAT for Client VPN only.

Thanks ^^

AM.    

[kprakash]

Good Morning,

Applications like Ping and ESP, do not have port numbers and have their own protocol numbers. When the PANFW receives these packets, and if there is a NAT rule applied to perform both address and port translation, the PANFW drops these ESP packets ( because there is no port information in the ESP header. Also note that the PANFW drops these packets only if it is configured to perform address and port translation. If configured to translate just the addresses, like when using static NAT, the PANFW wont drop the packets ).

If you want the PANFW to NAT the ESP packets, ensure that you have NAT Traversal configured on the end routers. With NAT-T configured, the routers encapsulate the ESP payload into a UDP PDU, which carries this information on port 4500. When the PANFW receives this packet, it can translate the port number and hence wont drop the ESP packets.

Hope that helps.

BR,

Karthik

[kprakash]

To answer you question, configure a NAT policy to NAT traffic on port 4500 for the VPN traffic. As mentioned earlier, you have to configure NAT traversal on both the  end routers