IPSec VPN Tunnel Interface with IP Addresses

[rmeddane]

I read the following example of Site to Site VPN IPsec with static routing :

https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/site-to-site-vpn-quick-c...

In the figure the example shown that both Tunnel Interfaces on the peers VPN are 10.10.10.10 and 10.10.10.11 in the same subnet.

But in the configuration, they use the following IP Addresses: 172.19.9.2/24 and 192.168.69.2/24, not in the same subnet.

[seb_rupik]

Hi there,

The section of the diagram which you have highlighted is the Layer3 tunnel interface. It is these interface addresses which would be used for routing within the which ever VR the interface belongs to. These could also be used for routing protocol peering. These IPs need to both be within the same subnet. However, since it is a point to point link a /30 is really preferable.

The section of text you have shown and highlighted are the IP addresses for the IPSec endpoints. These are the addresses which the IPSec process will attempt to connect to. In this example the default VR must have a route installed which allows it to reach the remote address. In reality you would expect the peer to be several hops away and certainly not within the same subnet (although in some topologies it is feasible).

cheers,

Seb.

[rmeddane]

@seb_rupik  The example shown the configuration of tunnel interface with virtual router , security zone and IPv4 Address by instructing to navigate to Interfaces > Tunnel.     And the IP address configured does not match with the IP address 10.10.10.10 displayed in the topology. NOT the IP addresses for the IPSec endpoints which the IPSec process will attempt to connect to.

[rmeddane]

@seb_rupik  It's definitely a mistake in the article and should be corrected in the configuration section to match the IP addresses of the tunnel interfaces shown in the topology 10.10.10.10 and 10.10.10.11.

Look at another example with OSPF, the configuration section shown the correct IP addresses 2.1.1.140 and 2.1.1.141, the same in the topology, and this is correct.

[seb_rupik]

hmmmm.... having read the documentation it is indeed conflicting and requires you to pick and choose between the text and the diagram. 

Personally I would take the tunnel IP addresses from the diagram, using a /30 instead and when defining the static route specify the next-hop IP address too. Certainly in Cisco IOS not doing this can result in poor ARP cache performance(...perhaps PA mitigates against this, although this is not mentioned in the text).

cheers,

Seb.

[rmeddane]

The article can cause confusion for beginners.