Route to IPSec Tunnel

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Route to IPSec Tunnel

L4 Transporter

Hi All,

I need to add a route pointing to a Tunnel interface. As the peer has dynamic IP have created the IPsec tunnel with Dynamic IP Peer Identification as its Hostname.

 

To Add route in the VR as we do not have IP address if i just point it to the tunnel interface and select IP address as none would be enough?

 

Or is there any other way to configure it?

Regards,

Sanjay S

 

2 REPLIES 2

L4 Transporter

Hi there,

To add a static route you would specify the tunnel next-hop along with the destination prefix. For the purpose of routing via the tunnel you do not worry about the remote end having a dynamic address, it is the encapsulated address that you are interested in and this will be static.

 

IP address, next-vr and FQDN are valid values for the mandatory next-hop field. Specifying the outbound interface is optional. It is worth noting that creating a static route without a next-hop address comes with the addtional baggage of increasing the ARP table. At least that is the case on other routing platforms, thankfully Palo Alto doesn't let you! I wrote a blog post about it if you are interested:

Static route next-hop – CS7 Networks

 

cheers,

Seb.

Cyber Elite
Cyber Elite

Hello,

When entering the static route, Enter the following:

Name: <whatever name you choose>

Destination: <Your ip/subnet in CIDR>

Interface: <Your tunnel interface>

Next Hope: NONE

 

Hopefully there is a corresponding route on the other side to get traffic back. 

Regards,

  • 717 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!