VPN tunnel moving from Palto-ASA to Palto-Palto

[iguarino]

I'm running PANOS 4.0.x and have a tunnel with a Cisco ASA peer.  I had to create multiple IPSEC tunnels to work around the Proxy ID limitation of 10 per tunnel interface.  This Cisco peer will be moving to a Palo Alto box running 5.0.x.  If the far end Palto running 5.0.x just matches my Proxy ID's, then I should be good correct?  And that 5.0.x Palto will not have to be configured with multiple tunnel interfaces, either.  I recall reading somewhere that VPN tunnels between Palto's didn't need Proxy ID's defined.  Just looking for clarification.  Thank you.

[HULK · Accepted solution]

Hello Iguarino,

You are correct. PAN firewall will take 0.0.0.0/0 as proxy ID by default. So, if both ends are PAN firewall then need not to define the Proxy ID's.

FYI:-

1. Define a proxy ID on PAN firewall for more control over the traffic, define the traffic that needs to be Encrypted or the Interested traffic for an IPSEC tunnel.

2. This behavior is same for JUNIPER SRX firewall as well.

Hope this helps.

Thanks

[iguarino]

Thanks HULK.  So in this case, the 4.0 side will simply add destination routes to the proper tunnel interface (although limited to 10).  The 5.0 side could add up to 250 destination routes pointing to its proper tunnel interface.

[HULK]

Yes, you are correct.

Thanks