Site to Site VPN config on Azure palo lato

[Amaresh]

Hi All,

I have created site to site VPN between Palo alto in azure and checkpoint firewall.

Created VPN on untrust interface (Public IP is mapped on that interface ) . Even the Phase 1 is not up.

Can anyone help me with config on azure palo alto

[johnsonto]

Amresh,

Would you be able to share any of your configuration?  

Todd

[Amaresh]

Thanks for your reply.

Is it ok If i upload the screenshoot of the config

[johnsonto]

Amaresh,

Sure.  I will take a look when I can.  

Thank you, 

Todd

[Amaresh]

[Amaresh]

Also configured routes and policies .

Note - The interface is mapped with Public IP on azure.

[johnsonto]

What do your logs say?  Have you run a debug on the ike yet?  If you are trying the connection take a look at the mp-log ikemgr.log and look at the messages.  Watching that will give you a good indication where the issue might be.  

Are you able to ping the public IP peer on the remote side?  I would also go over your ike/ipsec settings from the vendor and make sure you are matched up.  

Todd 

[mgarg]

look at the system logs and filter with (subtype eq vpn) .If you seel messages saying failing due to negotiation timeout then take a packet capture on palo alto and checkpoint to check if you are sending/receiving isakmp packets

Run a test vpn ike-sa gateway <gateway> and have a look at mp-log ikemgr.log for more info

[Amaresh]

Is there any docs available for the config of site to site VPN/Remote access VPN   in azure palo alto  .

Note - I do have docs related to appliance box.