Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
10-26-2016 09:38 AM
Hello Experts
I have site to site VPN between HQ PA and branch PA. I used the proxy id on HQ as Local: 172.16.110.0/24 remote: 10.10.10.0/24 and everything is working.
Now brach office need to access another subnet in HQ that is 172.16.111.0/24. In this case I have to create one more proxy id on both side or just allowing this new subnet in appropriate policies and proper route towards tunnel interface is enough?
My main point is proxy-id is just the parameter to match on both sides while negotiating IPSEC or its has anything to do with actual traffic passing through IPSEC?
10-28-2016 06:20 AM
It's my understanding that zero proxy-ids are necessary for a PA-PA VPN connection. the PA leverages the routing in your VR to define what traffic brings up your tunnel.
10-26-2016 11:50 AM
From multiple support cases I've had with TAC on IPSec tunnels on PAs. If the tunnel exists between two PAs Proxy IDs aren't necessary.
10-26-2016 12:33 PM
Ahh .. Agreed with Brandon. I thought the tunnel is between PA and third party firewall. More info here:
10-28-2016 03:48 AM
Hello
So between PA, if proxy-id is local: 10.0.0.0/8 and remote: 172.16.1.0/24 and tunnel is established. Now I need to pass another remote subnet 172.16.2.0/24 then in this case, I do not need to add another proxy-id for 172.16.2.0/24? Just appropirate policy and route towards tunnel for 172.16.2.0/24 is enough?
10-28-2016 06:20 AM
It's my understanding that zero proxy-ids are necessary for a PA-PA VPN connection. the PA leverages the routing in your VR to define what traffic brings up your tunnel.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
