Where to add Proxy ID with multiple tunnels?

[rjdahav163]

Hey all,

We have 3 firewalls:

C1 = Cisco FW - Policy based S2S VPN -- subnet behind it 10.1.0.0/24

P2 = Palo FW - Route based S2S VPN -- subnet behind it 172.16.50.0/24

C3 = Cisco FW - Policy based S2S VPN -- subnet behind it 192.168.20.0/24

We have S2S tunnels as: C1 <---- tunnel.1---> P2 <-----tunnel.2-----> C3

Proxy ID on P2 are:

For tunnel.1 = local: 172.16.50.0/24, remote: 10.1.0.0/24

For tunnel.2 = local: 172.16.50.0/24, remote: 192.168.20.0/24

Routing is all static.

Now 10.1.0.50 wants to reach 192.168.20.79. There cannot be a direct tunnel between C1 and C3 and hence this needs to go through P2. This is currently now working. If I add the both the remote proxy ids to both the tunnels, then atleast 1 tunnel and sometimes both go down. 

How can I get this working? Where and how do I add Proxy IDs?

Thanks!

[murali438]

For tunnel.1 you will have to use local PID # 192.168.20.0/24 , remote 10.1.0.0/24
For tunnel.2 you will have to use local PID # 10.1.0.0/24 , remote 192.168.20.0/24
remember to allow communication on your security policy from your VPN_ZONE to VPN_ZONE

[RusselMoos]

Hello Everyone, what happens when you have more than one subnet on both sides?  

Say I have Side A with 10.6.10.0/24 and 10.6.20.0/24 and on side B I have 10.1.10.0/24 and 10.1.20.0/24.  Nothing overlaps, but please tell me what the proxy ID's would look like.

I just have a single tunnel created between them.

[CosminM]

Hello @RusselMoos ,

Assuming that you need connectivity between all you distant subnet, then your Proxy-ID will have 4 rules, as follows for side A:

[RusselMoos]

Thank you Cosmin!  I will give that a try.