ProxyID for Prisma Access Tunnels

Reply
Highlighted
L2 Linker

ProxyID for Prisma Access Tunnels

Hi All,

            I have doubt in adding proxyID in the VPN settings, the confusion is whether infra ip will be my local id/remote id (based on locations), I have attached prisma sample diagram. Can someone confirm  local and remote ip for proxyid 1,2 for my understanding.prisma-access-for-networks-deployment-guide.png

 

 

with regards,

Ram

Tags (1)
Highlighted
L4 Transporter

Re: ProxyID for Prisma Access Tunnels

Highlighted
L2 Linker

Re: ProxyID for Prisma Access Tunnels

Hi Sai,

           I didn't get you.
From the diagram can you give me the local and remote ip address for proxy ID1 and proxy ID2.
I am confused because the actual communication is between 10.5.0.0 to 10.50.1.0. Infra subnet is in the middle and its primary purpose is to communicate resources in service connection.
So if you worked in prisma and can you give actual ip details for proxyids

 

with regards,

ram

Highlighted
L1 Bithead

Re: ProxyID for Prisma Access Tunnels

Hi Ram, 

 

Thanks for your query! Are you speaking to the Tunnel Monitoring config using Proxy ID on Page 74 and 75 of the Prisma Access Panorama Admin guide? 

 

https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/prisma/prisma-access/prisma-access-...

 

The context here is around the Tunnel monitoring a Service Connection. This will probe the IP's specified to be sure traffic is not black-holed to a site that has gone down. For the Proxy ID config of your tunnel monitor traffic, The local subnet is your Infrastructure subnet since either the SC or RN when onboarded in our cloud will pull from this pool. The remote will the on-prem remote site subnet, etc.. 

 

If you are not using proxy IDs for tunnel monitoring you can just specify an IP that can be reached (can route to that remote IP) and is allowed (security policy allowed). 

 

I hope this helps. 

 

Wade

Highlighted
L1 Bithead

Re: ProxyID for Prisma Access Tunnels

Ram,

The proxy information you configure in Panorama for your tunnel is pushed to the cloud firewalls, so the local entry refers to the cloud firewall the remote entry refers to your on-prem device. Please keep in mind that if the on-prem device is also a PAN firewall you do not need to enable proxy-IDs since they are route-based firewalls.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!