Route to IPSec Tunnel

[Sanjay_Ramaiah]

Hi All,

I need to add a route pointing to a Tunnel interface. As the peer has dynamic IP have created the IPsec tunnel with Dynamic IP Peer Identification as its Hostname.

To Add route in the VR as we do not have IP address if i just point it to the tunnel interface and select IP address as none would be enough?

Or is there any other way to configure it?

Regards,

Sanjay S

[seb_rupik]

Hi there,

To add a static route you would specify the tunnel next-hop along with the destination prefix. For the purpose of routing via the tunnel you do not worry about the remote end having a dynamic address, it is the encapsulated address that you are interested in and this will be static.

IP address, next-vr and FQDN are valid values for the mandatory next-hop field. Specifying the outbound interface is optional. It is worth noting that creating a static route without a next-hop address comes with the addtional baggage of increasing the ARP table. At least that is the case on other routing platforms, thankfully Palo Alto doesn't let you! I wrote a blog post about it if you are interested:

Static route next-hop – CS7 Networks

cheers,

Seb.

[OtakarKlier]

Hello,

When entering the static route, Enter the following:

Name: <whatever name you choose>

Destination: <Your ip/subnet in CIDR>

Interface: <Your tunnel interface>

Next Hope: NONE

Hopefully there is a corresponding route on the other side to get traffic back. 

Regards,