Site-To-Site VPN to VMWare VShield Edge?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Site-To-Site VPN to VMWare VShield Edge?

L4 Transporter

Greetings all.

 

We're in pre-deployment for our firewall and I'm attempting to get an Site-To-Site VPN tunnel set up to our VShield Edge setup in the cloud.  I have a tunnel established but we can't seem to get anything across it.

 

Troubleshooting so far:

  • Verified on the Traffic Monitor I can see my pings going from my inside trusted zone to our Site-To-Site VPN zone and that they're getting aged-out session ends.
  • "show vpn flow" is showing encap bytes increasing with no change in decap bytes which should mean I'm sending but I'm not receiving from the other side
  • I have an Interzone allow for any application with both my inside trusted zone and Site-to-Site zone added to the source and destinations
  • I created a NAT rule to set No-NAT for anything coming from my inside trusted zone to the host on the other side I'm trying to ping

We have a connection from our existing Cisco ASA to the VShield Edge setup that works and we're able to ping and pass traffic.  That setup has Reverse Route Injection configured.  The VShield Edge has no static routes configured (for the ASA VPN either) and it's interface is rather limited... apparently we don't have the Advanced Networking license.

 

Anyone have any ideas or have any experience with this?

 

Thanks!

1 accepted solution

Accepted Solutions

The issue ended up being with the Tunnel Monitor I had set up.  One of the PA techs got me a link to this article:

 

https://live.paloaltonetworks.com/t5/Configuration-Articles/Tunnel-Monitoring-for-VPN-between-PA-and...

 

I hadn't realized the monitoring packets are sent out every SA and not only the one that the target host falls in.  If any of those don't receive a response back (I'm assuming a "Host not reachable" would even suffice) due to a packet drop, then the tunnel monitor fails and starts trying to re-key constantly.

 

If tunnel monitors could be configured per SA or an SA selected to use for the one tunnel monitor then this could still work the way I was thinking but, the current software only has the one tunnel monitor that sends packets to the destination IP over every SA.

 

Our solution is going to be just to use the Dead Peer Detection with the IKE Gateway since the tunnel doesn't require any extrodinary measures to make sure it is up 100% of the time.

View solution in original post

2 REPLIES 2

L3 Networker

Halo,

 

Article below will help you to troubleshoot:

 

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Troubleshoot-IPSec-VPN-connectivity-...

 

Cheers 

The issue ended up being with the Tunnel Monitor I had set up.  One of the PA techs got me a link to this article:

 

https://live.paloaltonetworks.com/t5/Configuration-Articles/Tunnel-Monitoring-for-VPN-between-PA-and...

 

I hadn't realized the monitoring packets are sent out every SA and not only the one that the target host falls in.  If any of those don't receive a response back (I'm assuming a "Host not reachable" would even suffice) due to a packet drop, then the tunnel monitor fails and starts trying to re-key constantly.

 

If tunnel monitors could be configured per SA or an SA selected to use for the one tunnel monitor then this could still work the way I was thinking but, the current software only has the one tunnel monitor that sends packets to the destination IP over every SA.

 

Our solution is going to be just to use the Dead Peer Detection with the IKE Gateway since the tunnel doesn't require any extrodinary measures to make sure it is up 100% of the time.

  • 1 accepted solution
  • 3686 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!