VPN between 2 Palo Alto Firewalls

[harmander]

Hi there,

I am trying to setup VPN between 2 Palo Alto Firewalls. On one side I have public address but on the other side I am using a private ip address as this Palo Alto is behind a router. The VPN is not coming up. I also tried to do port forward from the router to the Palo Alto but still no success. What am I doing wrong here guys or will it work with this kind of setup at all?

Thanks

[emr_1]

Are you enabling NAT Traversal?

What does system-log say on both sides?

System log would be a hint to troubleshoot.

[TranceforLife]

Hello,

Here is a good explanation what is NAT-T:

http://www.internet-computer-security.com/VPN-Guide/NAT-T.html

Encapsulating IPSEC in UDP is likely to require an adjustment to the MSS on the firewall and on devices between the firewall and the internet because of the extra headers.

https://live.paloaltonetworks.com/t5/Configuration-Articles/NAT-Traversal-in-an-IPSEC-Gateway/ta-p/6...

After all this done,

Please check/post your ike logs, better from the responder side or both:

> tail lines 50 mp-log ikemgr.log

Thx,

Myky