03-28-2025 03:38 PM
I have a site to site configure and tunnel established between palo alto and juniper vsrx. I am trying to route an IPSec tunnel through the existing tunnel. I am able to ping through the existing tunnels so connectivity exist. I have applied and "ANY/ANY" policy as well. The issue I is the traffic from the "spoke/remote" is able to send the IKEv2 Initiation through the tunnel but the Hub response is never making it back. I see the session in the browser as being sent to the hub but again the return traffic is lost somewhere. If I connect Palo Alto to Palo Alto the inner tunnel establishes just fine through the outter tunnel. If I configure Juniper to Juniper same outcome. No ACL's or anything like that that are applied either.
04-01-2025 09:05 PM - edited 04-01-2025 09:06 PM
Hello @skey4867 ,
@skey4867 wrote:
I have a site to site configure and tunnel established between palo alto and juniper vsrx. I am trying to route an IPSec tunnel through the existing tunnel. I am able to ping through the existing tunnels so connectivity exist. I have applied and "ANY/ANY" policy as well. The issue I is the traffic from the "spoke/remote" is able to send the IKEv2 Initiation through the tunnel but the Hub response is never making it back. I see the session in the browser as being sent to the hub but again the return traffic is lost somewhere. If I connect Palo Alto to Palo Alto the inner tunnel establishes just fine through the outter tunnel. If I configure Juniper to Juniper same outcome. No ACL's or anything like that that are applied either.
Are you trying to do some tunnel in a tunnel?
Also, you can refer to https://live.paloaltonetworks.com/t5/pancast-episodes/pancast-episode-12-troubleshooting-ipsec-tunne... for some initial troubleshooting.
Olivier
PCSNE - CISSP
Best Effort contributor
Check out our PANCast Channel
Disclaimer : All messages are my personal ones and do not represent my company's view in any way.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
