Azure Palo VM IPSec Tunnel to another Azure Palo VM

[iamroott]

Hello,

I am running into an issue. I have 1 Azure subscription with multiple regions (US , Europe etc). I have a Palo Alto Virtual Appliance in front of each region. Which filters all traffic going to and from the regions. I have successfully built tunnels with no issues to my on premise Palo Altos, but can't seem to figure out why I can't build the tunnels from one VM in the US region to another VM in the Europe region.

Anytime I try to initiate the tunnels, the SA fails due to timeout. 

Now I tried to use UDRs to make sure that it wasn't taking any Azure backend routing. Tried ikev2/ikev1, auto/manual/aggressive modes, security policies, anything I could think of trying.

Has anyone successfully built IPSEC Tunnels from one PA VM to another PA VM within the same tenant?

Thanks.

[Dennisleon]

---

@iamroott wrote:

Hello,

I am running into an issue. I have 1 Azure subscription with multiple regions (US , Europe etc). I have a Palo Alto Virtual Appliance in front of each region. Which filters all traffic going to and from the regions. I have successfully built tunnels with no issues to my on premise Palo Altos, but can't seem to figure out why I can't build the tunnels from one VM in the US region to another VM in the Europe region.

Anytime I try to initiate the tunnels, the SA fails due to timeout. 

Now I tried to use UDRs to make sure that it wasn't taking any Azure backend routing. Tried ikev2/ikev1, auto/manual/aggressive modes, security policies, anything I could think of trying.

Has anyone successfully built IPSEC Tunnels from one PA VM to another PA VM within the same tenant?

Thanks.

---

Hello,

Certainly! Building IPsec tunnels between Palo Alto Networks VM-Series firewalls within the same Azure tenant is a common requirement for creating secure communication channels. Let’s address this issue step by step:

IKEv2 for Dynamic Routing:
Microsoft Azure requires IKEv2 for dynamic routing (also known as route-based VPN). IKEv1 is restricted to static routing only. Ensure that you’re using IKEv2 for your VPN configuration.
Verify that your Palo Alto Networks firewall is running PAN-OS 7.1.4 or a newer version, as these fully support the necessary route-based VPN and crypto profiles for connecting to Azure’s dynamic VPN architecture.

Configuration Steps:

Azure Configuration:

Deploy an Azure Virtual Network Gateway (if not already created).
Define IP address ranges for each local network site that you’ll be connecting to Azure. These ranges are essential for dynamic routing.
Refer to Microsoft’s documentation for detailed instructions on setting up the VPN gateway in the Azure environment.

Palo Alto Networks Firewall Configuration:

Tunnel Interface:
Inside the Palo Alto Networks WebGUI, navigate to Network > Interfaces > Tunnel.
Add a new tunnel interface.
Select a virtual router and an appropriate security zone.
Optionally, assign an IP address on the same subnet as the Azure Gateway for dynamic routing and/or tunnel monitoring within the IPv4 tab.

IKE Gateway:
Add an IKE Gateway in Network > Network Profiles > IKE Gateway.
Configure the IKEv2 parameters based on Microsoft Azure’s supported crypto parameters.

IPSec Crypto Profile:
Create an IPSec Crypto Profile with the necessary parameters (encryption, authentication, and DH group) that align with Azure’s requirements.

Security Policies:
Define security policies to allow traffic between the VMs in different regions.

Monitor and Troubleshoot:
Monitor the tunnel status and logs to identify any issues.
Check if there are any specific error messages related to the SA timeout.
Consider packet captures or debug logs to diagnose further.

Common Pitfalls:
Ensure that the public IP addresses used in your configuration are correct.
Verify that the security policies allow traffic between the VMs.
Double-check the IKE and IPSec parameters (encryption, authentication, DH group) to match Azure’s requirements.

I hope the information may helps you. 

[JayGolf]

Hi @iamroott ,

Could you share the system logs for the tunnel?