IPSEC Pass Through

Showing results for 
Show  only  | Search instead for 
Did you mean: 

IPSEC Pass Through

L0 Member

Forgive the newbie question, but I've been searching the documentation and I don't see where I can configure the Paloalto FW for vpn passthrough, specifically ESP (Protocol 50) and even ICMP.  I have some routers that I need to provide NAT for their external address, but I also want to limit the services available on the Internet to just PING reply, ESP, IKE and NAT-T.  I've added UDP service definitions for IKE and NAT-T, but I don't see anything for the others.  Can someone point me in the right direction?


L2 Linker

Hello Jeff,

Allowing ipsec application in your security policy will allow your PAN device to act as vpn passthrough.

ipsec application is containing sub-app: ike,ipsec-ah,ipsec-esp,ipsec-esp-udp(NAT-T) implicitly allowed.

To allow only icmp-ping, use ping application in your policy.

Hope this will help.



Hi nbilly,

Any possibility on services object to be configured? Because on NAT Policy I can't configure application. Just want to NAT for Client VPN only.

Thanks ^^


L5 Sessionator

Good Morning,

Applications like Ping and ESP, do not have port numbers and have their own protocol numbers. When the PANFW receives these packets, and if there is a NAT rule applied to perform both address and port translation, the PANFW drops these ESP packets ( because there is no port information in the ESP header. Also note that the PANFW drops these packets only if it is configured to perform address and port translation. If configured to translate just the addresses, like when using static NAT, the PANFW wont drop the packets ).

If you want the PANFW to NAT the ESP packets, ensure that you have NAT Traversal configured on the end routers. With NAT-T configured, the routers encapsulate the ESP payload into a UDP PDU, which carries this information on port 4500. When the PANFW receives this packet, it can translate the port number and hence wont drop the ESP packets.

Hope that helps.



To answer you question, configure a NAT policy to NAT traffic on port 4500 for the VPN traffic. As mentioned earlier, you have to configure NAT traversal on both the  end routers

  • 4 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!