Decommission IPSec site to site VPN

[Mohamed18]

Hi All,

I have been looking at the best way to decommission VPN tunnels on Palo Alto firewall, and I could only find disabling the IKE phase1 and the IPSec tunnels. is there a recommended way to decom IPSec VPN tunnels on Palo Alto firewalls?

Thank you in advance.

[Raido_Rattameister · Accepted solution]

If you want to decommission VPN then:

- Mark down tunnel interface number and zone tunnel is in Network > IPSec Tunnels, then delete the tunnel.
- Delete gateway from Network > Network Profiles > IKE Gateways
- Delete all static routes to tunnel interface identified in step 1 (Network > Virtual Routers)
- Delete tunnel interface itself Network > Interfaces > Tunnel

- Check if there are any NAT/Security policies related to zone where tunnel interface was in and if they are still needed.

If you don't want to delete but disable then both IKE Gateways (phase 1) and IPSec tunnels (phase 2) have disable option at the bottom of the page.

[Mohamed18]

Thank you Raido