Setting up an IPSEC VPN Tunnel on AWS

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Setting up an IPSEC VPN Tunnel on AWS

L0 Member

Hi Palo Alto community,

 

I've been trying to follow this guide to set up a static IPSEC tunnel on AWS between two VPCs but having a bit of trouble:

https://knowledgebase.paloaltonetworks.com/servlet/fileField?entityId=ka10g000000D8OjAAK&field=Attac...

 

This is my network diagram:

 

range drawing palo alto.png

 

 

This is my configuration for the firewall in VPC A:

1.PNG2.PNG3.PNG4.PNG5.PNG

 

This is my configuration for the firewall in VPC B:

r2_1.PNGr2_2.PNGr2_3.PNGr2_4.PNGr2_5.PNG

 

I had also added some firewall rules that weren't in the screenshots according to the guide but that didn't help turn the IPSEC tunnel status green either.

I also ran the command show vpn flow in the CLI but the state remains "init" on the tunnel:

show vpn flow.PNG

 

Any suggestions would be appreciated, pretty new to using PA as I've been using mostly cisco/pfSense up to this point, thanks!

1 accepted solution

Accepted Solutions

So the support team resolved it.. it was due to the tunnel endpoint sitting on the same subnet as the private subnet on VPC 1.. apparently you need some subnet indicator on the 10.60.66.14 or it won't know where the gateway is, even if you hardcode the ARP. We solved the issue by making another subnet at 10.60.0.0/24 and used that for E1/1 in VPC 1.

 

I also needed to setup static routing config on the virtual router for E1/1.

 

Finally, we needed to run the following two commands to manually initiate the tunnel.

test vpn ike-sa gateway [ike gateway name]

test vpn ipsec-sa tunnel [tunnel name]

View solution in original post

2 REPLIES 2

Cyber Elite
Cyber Elite

Hello,

Check the logs to see if the packets are getting from one pan to the other. If not it could be the AWS ACL firewall or your security groups are preventing the communication.

 

Hope that helps.

So the support team resolved it.. it was due to the tunnel endpoint sitting on the same subnet as the private subnet on VPC 1.. apparently you need some subnet indicator on the 10.60.66.14 or it won't know where the gateway is, even if you hardcode the ARP. We solved the issue by making another subnet at 10.60.0.0/24 and used that for E1/1 in VPC 1.

 

I also needed to setup static routing config on the virtual router for E1/1.

 

Finally, we needed to run the following two commands to manually initiate the tunnel.

test vpn ike-sa gateway [ike gateway name]

test vpn ipsec-sa tunnel [tunnel name]

  • 1 accepted solution
  • 24490 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!