IPSec VPN Proxy ID setup with multiple encryption domains on a policy based VPN peer

[pmcelwee]

I need to establish VPNs from a PA5050 to Cisco devices where there are multiple encryption domains at the Cisco end.

I understand using one proxy id on the PAN to match one encryption domain on the Cisco, i.e. connecting route based to policy based VPN devices.

My question is how to set up multiple Proxy IDs from a PAN device to match multiple encryption domains on a Cisco VPN peer.

Do you set up multiple IPSec tunnels on the PAN device, each with one proxy ID using the same tunnel interface and route the remote Proxy ID IP blocks to the tunnel?

To set up this environment on Netscreen Screen OS devices, NHTB is used to bind multiple Proxy IDs to a tunnel. Is there any similar concept for PAN devices?

Thanks for any insight.

[zarina · Accepted solution]

You can add multiple proxy ids to the same tunnel instead of creating multiple tunnels. Please note that pre-5.0 only 10 proxy ids are supported per tunnel.

[UhMayYeah]

Each tunnel can have up to 10 proxy IDs. If you need more proxy IDs to the remote location you can configure a second tunnel to the VPN peer for the other proxy IDs.

Refer:

-Ameya