Palo alto Active/passive HA on azure with IPsec VPN tunnel

[louey11]

Hello,

I am deploying an Active/Passive Palo Alto HA VM's on Azure with an external and internal loadbalancer topology (picture below), I know that the NAT is done by the public Loadbalancer so no need for public IP address on the VM's interfaces so need for public IP on interfaces for this purpose, but i need to set a VPN IPsec connections between my PA-VM's and other sites, so how would I configure the VPN IPsec tunnels, should I put the Public IP of the loadBalancer on the peer IP or the private IP of the VM's or should I literally configure my PA-VM's with Public IP on external interfaces.

I am really blocked with this point, if anyone could help i will be really grateful.

Thank you in advance

Louey

[skumar1]

@louey11 

You can use the private ip address on the firewall itself but make sure you use local identifier and remote identifier option on both sides of the tunnel to make this work. (imagine if your side ip is dynamic ip then how do you configure, the same way)

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHVCA0

Cheers!

Suresh

[BPry]

@louey11,

If you don't want to use a dynamic configuration, which is by far the easiest, I would recommend that you setup a public IP directly on the PAs and not go through the load balancer. While it will work, it'll take a bit of tweaking to ensure that the load balancer isn't causing any issues since it'll be considered a long running session. 

[Thanjalo_Thankappan]

Hi

Did you manage to get this problem resolved? I am going through a similar project at the moment and would appreciate any feedback that you may have.

Thanks

[BilalMohd]

@louey11 Did you find the solution as it is a very old thread. If yes, can you please share any suggestions or documentations for using this setup of having external load balancer in front of PA VMs which are in Active/Passive mode. I am still looking for a solution on this. Any help would be appreciated @BPry .