Hi, If palo alto sits behind a router (NAT) and palo alto external IP is a private IP (192.168.x.x), can setup a site-to-site IPsec VPN/GRE tunnel with remote site router (public external IP)? please advise, thanks in advance.
thanks for posting in LIVEcommunity!
I have one site where due to circuit/ISP limitation, PA Firewall is sitting behind a device doing NAT. The PA has on its untrust interface assigned IP address in 192.168.X.X range. This scenario is functional to build an IPsec tunnel as long as NAT device in between can do a bidirectional NAT. There is a KB describing this scenario: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClopCAC
As part of IPsec phase1 negotiation both peers are using identifications (ID). By default peer IP (local and remote) is used if no explicit ID is used. So configuring tunnel with peer behind NAT is pretty much the same as normal IPSec with to critical components that are mandatory for NAT to work:
- Enable NAT-T (nat traversal) to allow ESP encapsulation in UDP - ESP cannot be NATed, so NAT-T encapsulate ESP in UDP so it can be forwarded over NAT device. This must be enable on peers
- Use FW IP (the one assigned on fw interface) as Identification. On the FW behind the NAT, you need to set local id as type IP and put the private IP. For the other peer you need to set remote ID as type IP and put the private IP for the fw behind the nat.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!