Pa VPN IPsec

[atelcom]

Hi,

i have a question regarding the VPN IPsec on Paloalto , is palotlo must be in front end when configuring the PA

Regards,

Sarah

[HULK]

Hello Sarah,

Could you please explain, what do you mean by "front end". It will help us to understand your exact requirement.

Thanks

[ssharma]

Hi Sarah,

No that is not a requirement. You can use it as Pass through device as well, where it treats IPSec traffic as any other traffic and allows or denies as per policy configured. Though there are benefits with respect to threats, replay attacks when you configure it as front end or edge device but that is not a requirement.

Hope this helps. Thank you.

[atelcom]

here is the architecture,i want to know if the vpn ipsec must be configured on the stonsoft ,

or we can do that in the PA with private addresses

[atelcom]

Yeah i know that,but i want to know if i can configure the vpn ipsec on the paloalto with private adresses

thank you

regards,

Sarah

[HULK]

Hello atelcom ,

Yes, You can configure the VPN tunnel with Private IP.

Thanks

[ssharma]

Yes, you can configure it with private address as well. The requirement is same as with public IP all phase 1 and phase 2 should match. Otherwise there is no difference. Hope this helps. Thank you.

[HULK]

Hello Sarah,

You may follow this KB article How to Configure IPSEC VPN

> Make sure PAN has been always the VPN initiator ( enable "passive mode" in other end device)

> Enable NAT-Traversal on both end firewalls.

Thanks