can setup site-to-site ipsec vpn if palo alto firewall sits behind a router (NAT)?

[jiakeai1999]

Hi, If palo alto sits behind a router (NAT) and palo alto external IP is a private IP (192.168.x.x), can  setup a site-to-site IPsec VPN/GRE tunnel with remote site router (public external IP)? please advise, thanks in advance. 

[ManojV5]

Hi - Have you done this setup, I need help. If you have implemented could you please share the steps?

[PavelK]

Hello @ManojV5 

thanks for posting in LIVEcommunity!

I have one site where due to circuit/ISP limitation, PA Firewall is sitting behind a device doing NAT. The PA has on its untrust interface assigned IP address in 192.168.X.X range. This scenario is functional to build an IPsec tunnel as long as NAT device in between can do a bidirectional NAT. There is a KB describing this scenario: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClopCAC 

Kind Regards

Pavel

[aleksandar.astardzhiev]

Hi @jiakeai1999 , @ManojV5 ,

As part of IPsec phase1 negotiation both peers are using identifications (ID). By default peer IP (local and remote) is used if no explicit ID is used. So configuring tunnel with peer behind NAT is pretty much the same as normal IPSec with to critical components that are mandatory for NAT to work:

- Enable NAT-T (nat traversal) to allow ESP encapsulation in UDP - ESP cannot be NATed, so NAT-T encapsulate ESP in UDP so it can be forwarded over NAT device. This must be enable on peers

- Use FW IP (the one assigned on fw interface) as Identification. On the FW behind the NAT, you need to set local id as type IP and put the private IP. For the other peer you need to set remote ID as type IP and put the private IP for the fw behind the nat.