Azure Palo VM IPSec Tunnel to another Azure Palo VM

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Azure Palo VM IPSec Tunnel to another Azure Palo VM

L0 Member

Hello,

I am running into an issue. I have 1 Azure subscription with multiple regions (US , Europe etc). I have a Palo Alto Virtual Appliance in front of each region. Which filters all traffic going to and from the regions. I have successfully built tunnels with no issues to my on premise Palo Altos, but can't seem to figure out why I can't build the tunnels from one VM in the US region to another VM in the Europe region.

 

Anytime I try to initiate the tunnels, the SA fails due to timeout. 

 

Now I tried to use UDRs to make sure that it wasn't taking any Azure backend routing. Tried ikev2/ikev1, auto/manual/aggressive modes, security policies, anything I could think of trying.

 

Has anyone successfully built IPSEC Tunnels from one PA VM to another PA VM within the same tenant?

 

Thanks.

2 REPLIES 2

L0 Member

@iamroott wrote:

Hello,

I am running into an issue. I have 1 Azure subscription with multiple regions (US , Europe etc). I have a Palo Alto Virtual Appliance in front of each region. Which filters all traffic going to and from the regions. I have successfully built tunnels with no issues to my on premise Palo Altos, but can't seem to figure out why I can't build the tunnels from one VM in the US region to another VM in the Europe region.

 

Anytime I try to initiate the tunnels, the SA fails due to timeout. 

 

Now I tried to use UDRs to make sure that it wasn't taking any Azure backend routing. Tried ikev2/ikev1, auto/manual/aggressive modes, security policies, anything I could think of trying.

 

Has anyone successfully built IPSEC Tunnels from one PA VM to another PA VM within the same tenant?

 

Thanks.


Hello,

 

Certainly! Building IPsec tunnels between Palo Alto Networks VM-Series firewalls within the same Azure tenant is a common requirement for creating secure communication channels. Let’s address this issue step by step:

 

IKEv2 for Dynamic Routing:
Microsoft Azure requires IKEv2 for dynamic routing (also known as route-based VPN). IKEv1 is restricted to static routing only. Ensure that you’re using IKEv2 for your VPN configuration.
Verify that your Palo Alto Networks firewall is running PAN-OS 7.1.4 or a newer version, as these fully support the necessary route-based VPN and crypto profiles for connecting to Azure’s dynamic VPN architecture.


Configuration Steps:


Azure Configuration:

Deploy an Azure Virtual Network Gateway (if not already created).
Define IP address ranges for each local network site that you’ll be connecting to Azure. These ranges are essential for dynamic routing.
Refer to Microsoft’s documentation for detailed instructions on setting up the VPN gateway in the Azure environment.


Palo Alto Networks Firewall Configuration:


Tunnel Interface:
Inside the Palo Alto Networks WebGUI, navigate to Network > Interfaces > Tunnel.
Add a new tunnel interface.
Select a virtual router and an appropriate security zone.
Optionally, assign an IP address on the same subnet as the Azure Gateway for dynamic routing and/or tunnel monitoring within the IPv4 tab.


IKE Gateway:
Add an IKE Gateway in Network > Network Profiles > IKE Gateway.
Configure the IKEv2 parameters based on Microsoft Azure’s supported crypto parameters.


IPSec Crypto Profile:
Create an IPSec Crypto Profile with the necessary parameters (encryption, authentication, and DH group) that align with Azure’s requirements.


Security Policies:
Define security policies to allow traffic between the VMs in different regions.


Monitor and Troubleshoot:
Monitor the tunnel status and logs to identify any issues.
Check if there are any specific error messages related to the SA timeout.
Consider packet captures or debug logs to diagnose further.


Common Pitfalls:
Ensure that the public IP addresses used in your configuration are correct.
Verify that the security policies allow traffic between the VMs.
Double-check the IKE and IPSec parameters (encryption, authentication, DH group) to match Azure’s requirements.

I hope the information may helps you. 

 

 

 

 

Community Team Member

Hi @iamroott ,

 

Could you share the system logs for the tunnel? 

LIVEcommunity team member
Stay Secure,
Jay
Don't forget to Like items if a post is helpful to you!

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.
  • 773 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!