Limitations for creating number of child sa for site to site vpn

[veerrohitparihar2]

Hi,

Here I am trying to create a site to site vpn in Paloalto firewall, now in local network I have 8 individual /32 ips and for remote 10 individual /32 ips. This is for policy based vpn. Now if I add proxy ids for local and remote ips. I am getting around 80 proxy ids. Requirement is to only use ips not subnets. Now few connections are not working though it is allowed and phase 2 is up. I want to confirm if there is any limitations in creating total numbers of proxy ids and if it creates any impact in performance of the firewall?

[reaper]

proxy id's are essentially individual vpn tunnels, so you're setting up 80 vpn tunnels

what kind of platform are you stting this up on? 

[veerrohitparihar2]

We are creating a single site to site vpn between PA-220 and FTD firewall and within that multiple /32 ips needs to communicate

[OtakarKlier]

Hello,

See if the IP's can fit into a subnet. Also you can just create one proxy id, all the ip's/subnets and then use policies to limit the traffic.

Just some thoughts.

[BPry]

@veerrohitparihar2,

Correct, but as @reaper mentioned in his previous comment any time you add a proxy id you are essentially adding another tunnel. So as far as your firewall is concerned it's going to create what amounts to 80 tunnels to support all of the Proxy IDs you are trying to configure. 

[veerrohitparihar2]

I just found my answer in the PaloAlto PSNSE Study guide, under Topic Tunnel interface. " Tunnel interface can have a maximum of 250 proxy IDs. Each proxy ID counts toward the IPsec VPN tunnel capacity of the firewall, and the tunnel capacity varies by the firewall model. "