Site-to-Site VPN question

[Bvance]

I'm setting up a site-to-site VPN with static routes, which means the tunnel interface doesn’t need an IP address. But I would like to turn on tunnel monitoring and that does require an IP address on the tunnel interface. My question is does this IP need to be an actual publicly accessible IP or is it just two private IP's I define, both VPN peers in the same scope, for pinging?

[_slv_ · Accepted solution]

Hi Bcance

Please follow this doc https://live.paloaltonetworks.com/t5/Configuration-Articles/Dead-Peer-Detection-and-Tunnel-Monitorin...

In my opinion You can use any two private IP's.

Regards

Slawek

[pankaku · Accepted solution]

You can use any IP address for tunnel interface just make sure that ip adddress on tunnel interface of both side are in same subnet. For example you can use 192.168.1.1/30 and 192.168.1.2/30. 

[_slv_ · Accepted solution]

Hi Bcance

Please follow this doc https://live.paloaltonetworks.com/t5/Configuration-Articles/Dead-Peer-Detection-and-Tunnel-Monitorin...

In my opinion You can use any two private IP's.

Regards

Slawek

[pankaku · Accepted solution]

You can use any IP address for tunnel interface just make sure that ip adddress on tunnel interface of both side are in same subnet. For example you can use 192.168.1.1/30 and 192.168.1.2/30. 

[Bvance]

Thanks for you help pakumar.

[Bvance]

Thanks slv