Palo Alto - GPVPN - IPSEC b2b

[mcronin]

My current role is as a Network Architect and I am working with our security team to get some Palo Alto firewalls setup to provide

GPVPN access and also IPSEC b2b connectivity.

Our initial design has a single external public address to host the GPVPN traffic and the IPSEC b2b traffic and works ok. We are currently discussing the option of implementing a 2nd public address so that we can split the GPVPN and IPSEC b2b traffic on to separate interfaces which seems to make sense.

We are also hearing from the security department that they would like to see each IPSEC b2b tunnel terminated on an individual public IP address which we are going to discuss.

What are your thoughts on this

Option 1 -  Stay with a single public IP to terminate GPVPN and b2b IPSEC tunnels

Option 2-   Have a Public IP for GPVPN and a 2nd Public IP's for "ALL" b2b IPSEC tunnels

Option 3 - Have a Public IP for GPVPN and multiple Public IP's - 1 for each IPSEC tunnel

          20 tunnels - 20 public IP's      50 tunnels - 50 public IP's

I am expecting a lot of people to come back with either option 1 or option 2 but I am interested to see if anyone

thinks option 3 is a good idea.

[S.Cantwell]

Howdy

Option 2 is what you should be using.

Option 3 is definitely not needed.  Having unique public IP does not provide additional security, only additional option for potential misconfiguration and challenging troubleshooting.

I would be using public IP with loopback addresses vs exposing the true public IP associated with your 2 ethernet interfaces.

[aleksandar.astardzhiev]

Hi@S.Cantwell and what will be the benefit of option 2?

@mcroninI would personally go for option 1:

- The other two options bring unnecessary complexity. One public IP for site-to-site and RA VPN is simple and easy to support

- If you enable GP VPN on the same interface that you use for site-to-site or on a separate, you still need to expose it and open the required ports. If it reachable from internet any scanner will detect it and will try to exploit.

[OtakarKlier]

Hello,

I would say Option 1 or 2. Both have advantages and disadvantages. I would say make sure that whatever the internal to external NAT should be different just in case a VPN user does something goofy and get that IP blocked some how it wont affect other services.

Cheers!