- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
01-08-2013 11:21 AM
Forgive the newbie question, but I've been searching the documentation and I don't see where I can configure the Paloalto FW for vpn passthrough, specifically ESP (Protocol 50) and even ICMP. I have some routers that I need to provide NAT for their external address, but I also want to limit the services available on the Internet to just PING reply, ESP, IKE and NAT-T. I've added UDP service definitions for IKE and NAT-T, but I don't see anything for the others. Can someone point me in the right direction?
01-08-2013 11:55 PM
Hello Jeff,
Allowing ipsec application in your security policy will allow your PAN device to act as vpn passthrough.
ipsec application is containing sub-app: ike,ipsec-ah,ipsec-esp,ipsec-esp-udp(NAT-T) implicitly allowed.
To allow only icmp-ping, use ping application in your policy.
Hope this will help.
Regards
-Nicolas
09-16-2013 01:19 AM
Hi nbilly,
Any possibility on services object to be configured? Because on NAT Policy I can't configure application. Just want to NAT for Client VPN only.
Thanks ^^
AM.
09-16-2013 05:58 AM
Good Morning,
Applications like Ping and ESP, do not have port numbers and have their own protocol numbers. When the PANFW receives these packets, and if there is a NAT rule applied to perform both address and port translation, the PANFW drops these ESP packets ( because there is no port information in the ESP header. Also note that the PANFW drops these packets only if it is configured to perform address and port translation. If configured to translate just the addresses, like when using static NAT, the PANFW wont drop the packets ).
If you want the PANFW to NAT the ESP packets, ensure that you have NAT Traversal configured on the end routers. With NAT-T configured, the routers encapsulate the ESP payload into a UDP PDU, which carries this information on port 4500. When the PANFW receives this packet, it can translate the port number and hence wont drop the ESP packets.
Hope that helps.
BR,
Karthik
09-16-2013 06:13 AM
To answer you question, configure a NAT policy to NAT traffic on port 4500 for the VPN traffic. As mentioned earlier, you have to configure NAT traversal on both the end routers
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!