VPN from Palo to Cloud – Physical Interface or Loopback?

[Networksteam]

Just wondering what is best practice for this?

We have a /29 on our outside interface. We are using the IP assigned for client NAT translation.

Over the coming months we’ll be configuring several VPNs to the same cloud provider.

Should these terminate via a loopback or just on the physical interface and we should add an address to the physical interface?

[ThomasYarger · Accepted solution]

Hello, 

I typically use a loopback interface to save a physical port. I don't believe there is a right/wrong answer here just depending on your requirements and preference. I hope this helps. 

[Networksteam]

Thanks.

We use Global Protect via a loopback.

I think I will use the physical outside interface for VPN, and keep it simple.