ProxyID for Prisma Access Tunnels

[RamBalaji]

Hi All,

            I have doubt in adding proxyID in the VPN settings, the confusion is whether infra ip will be my local id/remote id (based on locations), I have attached prisma sample diagram. Can someone confirm  local and remote ip for proxyid 1,2 for my understanding.

with regards,

Ram

[Sai_Tumuluri]

Ram, 

it's local/remote. 

References: 

• Step 9 of https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/vpns/site-to-site-vpn-concepts/set-up-site...
• https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/network/network-ipsec-tunnels...

[RamBalaji]

Hi Sai,

           I didn't get you.
From the diagram can you give me the local and remote ip address for proxy ID1 and proxy ID2.
I am confused because the actual communication is between 10.5.0.0 to 10.50.1.0. Infra subnet is in the middle and its primary purpose is to communicate resources in service connection.
So if you worked in prisma and can you give actual ip details for proxyids

with regards,

ram

[wprice]

Hi Ram, 

Thanks for your query! Are you speaking to the Tunnel Monitoring config using Proxy ID on Page 74 and 75 of the Prisma Access Panorama Admin guide? 

https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/prisma/prisma-access/prisma-access-...

The context here is around the Tunnel monitoring a Service Connection. This will probe the IP's specified to be sure traffic is not black-holed to a site that has gone down. For the Proxy ID config of your tunnel monitor traffic, The local subnet is your Infrastructure subnet since either the SC or RN when onboarded in our cloud will pull from this pool. The remote will the on-prem remote site subnet, etc.. 

If you are not using proxy IDs for tunnel monitoring you can just specify an IP that can be reached (can route to that remote IP) and is allowed (security policy allowed). 

I hope this helps. 

Wade

[Rob_Notman]

Ram,

The proxy information you configure in Panorama for your tunnel is pushed to the cloud firewalls, so the local entry refers to the cloud firewall the remote entry refers to your on-prem device. Please keep in mind that if the on-prem device is also a PAN firewall you do not need to enable proxy-IDs since they are route-based firewalls.