S2S IPsec VPN with Multiple Domain Encryption

[R.Thakar]

We have experiencing difficulties having more than one domain encryption in IPsec tunnel, specifically when both are in the same subnet. Only one domain encryption remains active in the IPsec phase2. There are few times you can bounce IPsec gateway and restore connection to affected domain encryption, but after some time again connection lost to the node. Please assist.

#PA1420

[Raido_Rattameister]

Palo can't care less about ProxyID's / encryption domains.

They are there only to make peer side happy when peer supports policy based VPN.

Palo uses routing table to decide where traffic should go to.

If you have 2 Palos, then you don't need to use ProxyID at all and then both sides will send 0.0.0.0/0 over to each other behind the scenes.

[R.Thakar]

I have PA1420 on my side but remote Peer has Cisco NGFW using Policy based VPN. how will these two behave on handling multiple domain encryptions?

[Raido_Rattameister]

Ok in this case you do need ProxyIDs.

You mentioned they are overlapping.

Can you bring few examples how they overlap?

[R.Thakar]

sorry, I cant recall how I used the word "overlapping". But the how it was is, we have one Domain encryption on PA side, and two Domain encryption from remote peer who are using cisco NGFW. And,

Kind of strange, I tried to create rule for each domain encryption and put /32 on each IP and seems okay now. Any idea on this?

[Raido_Rattameister]

I interpreted "specifically when both are in the same subnet" as "overlapping".

Palo does not try to keep tunnels/proxyid's/encryption-domains active if there is no traffic trying to pass tunnel.

So if your Phase 2 timeout is 1 hour and no traffic for this time then tunnel is taken down.

If it bothers you, then you can configure tunnel monitoring in IPSec config or path monitoring in virtual router to keep tunnels up.