IPSEC Tunnel query

[Khanna075]

What is the use of Proxy ID in IPSEC tunnel configuration on Palo Alto ? When will it get negotiated and how ?

[SutareMayur · Accepted solution]

Hi @Khanna075 

Proxy-ID in Palo Alto is nothing, but interesting traffic flowing through the tunnel. Palo Alto by default only supports ROUTE BASED VPN.

Now in any case when you form tunnel from Palo Alto to the PEER which is configured/acting as POLICY BASED VPN, Proxy-ID on Palo Alto side must be configured.

And the subnets configured in Proxy-ID and the ACL on the PEER side should match for successful negotiation. This will be evaluated during PHASE-2 negotiation.

If it is not matched/identical then PHASE-2 negotiation will not be successful, and you can review related logs under system logs by filtering ‘VPN’.

If both ends are acting as Route Based VPN, there is no need of defining proxy-ids.

If you defined proxy-id in this case also, anyways it is not going to be evaluated during PHASE-2 negotiation.

You can refer below Palo Alto provided ref articles.

Hope it helps!

Ref Article 1 

Ref Article 2 

[Khanna075]

Thank you for the explanation. 
This makes sense to me now. 

[SutareMayur]

Hi @Khanna075 Glad to know that it helped you. 

Could you please click Accept as Solution to acknowledge that the answer to your question has been provided ? This will help other readers also.

Thank you!

[Khanna075]

Yes, sure!

[Khanna075]

By the way I browsed to your youtube channel. Its looks good. Thank you for sharing it.