Site-to-Site Palo Alto VPN is Failing

[sophia.legare]

I apologize if this is posted in the wrong message board. It is unclear to me where I should specifically be asking this type of question. 

I configured a site-to-site IPSec VPN between two Palo Alto's and they are both failing on Phase 1 and Phase 2. The local addresses are in the same IP address range and I am not able to change them. A test VPN was setup with different internal IP ranges works, but to try and make the internal ranges work, we are NATing the internal ranges to a unique NAT range. 

I had followed the directions from this article and double checked the configuration: https://faatech.be/palo-alto-networks-ipsec-site-to-site-with-overlapping-subnets-networks/. We will also need to configure both network with additional zones traversing the tunnel, but have not done anything with that yet as we cannot get the first zone working. 

I am happy to provide any error messages and configs if anyone needs them. Thanks in advance!

[upelister]

Hello,

Option 1;

-Use nat on both side and enter routes for nat ip adresses.

-I know if both side is Palo Alto you do not need to enter a Proxy id. but I am entering as 0.0.0.0/0 in both side every time (My behaveior 🙂 )

-Option 2;

-İf NAT is not an option and devices are directly connect to Firewall you can use PBR only for source and destionation ip addresses and ports. More specific is more accurate.

I hope these solutions helps.