IPSEC VPN through PAN comes up but does not pass traffic

[tuckert]

What needs to be enabled to allow a VPN that once worked to be allowed through a 3020. I had a Juniper to Juniper IPSEC VPN that worked before the 3020 was placed between the 2 junipers. What needs to be allowed to make sure that the traffic passes.The VPN comes up,but no data is able to pass

[kprakash]

Please check if

1) you have the correct proxy ids configured on both the firewalls ( the local and the remote networks must be mirror images on both the firewalls )

2) You have the routes configured on the tunnel interface for the remote network ( If the Juniper firewalls supported policy based VPNs, we do not have tunnel interfaces and hence no routes for  the remote network, on the Juniper firewall)

3) Check if you have the policies configured correctly for the zones ( the tunnel interface should be assigned to a zone and a virtual router, and we must have the appropriate policies in place to allow end to end traffic)

BR,

Karthik

[mbutt]

In addition to what karthik said below doc explains Why is a Proxy-ID Required for VPNs between PAN and Firewalls that Support Policy Based VPNs?

https://live.paloaltonetworks.com/docs/DOC-3073

Hope this helps you resolve the issue.

Thanks

Numan