Where to add Proxy ID with multiple tunnels?

[rjdahav163]

Hey all,

We have 3 firewalls:

C1 = Cisco FW - Policy based S2S VPN -- subnet behind it 10.1.0.0/24

P2 = Palo FW - Route based S2S VPN -- subnet behind it 172.16.50.0/24

C3 = Cisco FW - Policy based S2S VPN -- subnet behind it 192.168.20.0/24

We have S2S tunnels as: C1 <---- tunnel.1---> P2 <-----tunnel.2-----> C3

Proxy ID on P2 are:

For tunnel.1 = local: 172.16.50.0/24, remote: 10.1.0.0/24

For tunnel.2 = local: 172.16.50.0/24, remote: 192.168.20.0/24

Routing is all static.

Now 10.1.0.50 wants to reach 192.168.20.79. There cannot be a direct tunnel between C1 and C3 and hence this needs to go through P2. This is currently now working. If I add the both the remote proxy ids to both the tunnels, then atleast 1 tunnel and sometimes both go down. 

How can I get this working? Where and how do I add Proxy IDs?

Thanks!

[murali438]

For tunnel.1 you will have to use local PID # 192.168.20.0/24 , remote 10.1.0.0/24
For tunnel.2 you will have to use local PID # 10.1.0.0/24 , remote 192.168.20.0/24
remember to allow communication on your security policy from your VPN_ZONE to VPN_ZONE