can setup site-to-site ipsec vpn if palo alto firewall sits behind a router (NAT)?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

can setup site-to-site ipsec vpn if palo alto firewall sits behind a router (NAT)?

L0 Member

Hi, If palo alto sits behind a router (NAT) and palo alto external IP is a private IP (192.168.x.x), can  setup a site-to-site IPsec VPN/GRE tunnel with remote site router (public external IP)? please advise, thanks in advance. 

3 REPLIES 3

L1 Bithead

Hi - Have you done this setup, I need help. If you have implemented could you please share the steps?

Cyber Elite
Cyber Elite

Hello @ManojV5 

 

thanks for posting in LIVEcommunity!

 

I have one site where due to circuit/ISP limitation, PA Firewall is sitting behind a device doing NAT. The PA has on its untrust interface assigned IP address in 192.168.X.X range. This scenario is functional to build an IPsec tunnel as long as NAT device in between can do a bidirectional NAT. There is a KB describing this scenario: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClopCAC 

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

Cyber Elite
Cyber Elite

Hi @jiakeai1999 , @ManojV5 ,

As part of IPsec phase1 negotiation both peers are using identifications (ID). By default peer IP (local and remote) is used if no explicit ID is used. So configuring tunnel with peer behind NAT is pretty much the same as normal IPSec with to critical components that are mandatory for NAT to work:

- Enable NAT-T (nat traversal) to allow ESP encapsulation in UDP - ESP cannot be NATed, so NAT-T encapsulate ESP in UDP so it can be forwarded over NAT device. This must be enable on peers

- Use FW IP (the one assigned on fw interface) as Identification. On the FW behind the NAT, you need to set local id as type IP and put the private IP. For the other peer you need to set remote ID as type IP and put the private IP for the fw behind the nat.

 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!