Paloalto routing an IPSEC tunnel to another router

[alexcoxie]

Hello, I'm trying to create a tunnel between R1 (OpnSense) and R3 (Sophos), R2 is the Paloalto that NATs a dedicated wan IP to interface1/2 (private TRUST LAN) where is locally connected the Sophos.

R1 (Opnsense) <----->  R2 (Paloalto NAT 1:1) <-----> R3 (Sophos)

I have setup all the IPSEC IKE2 tunnels on R1 and R3,  on R2 i did the NAT1:1 with Dinamic IP and Port on both inbound and outbound sides,  so the clients on R3 have the Public IP that i set,  the NAT is working fine with the TCP ports.

NAT

Security (86 apps seen)

The problem is the the tunnel is not initialized, I can't see any package arriving from the R1 to R2 on UPD 500/4500.

what could be? It is possible to do this configuration ? (R2 routes the tunnel between R1 and R3 only with a NAT?)

Thank you.

[OtakarKlier]

Hello,

Do you also have the appropriate security policies in place to allow the traffic? Check the Unified logs to see if the traffic is allowed or blocked.

Regards,