Public CIDRs over VPN to Oracle Cloud Infrastructure

[coltsfanatic07]

I have setup a valid VPN connection to Oracle Cloud Infrastructure leveraging to IPSEC tunnels and we can route traffic like ICMP with no problem. When trying to access public cloud services via the VPN with private transit routing through the tunnel into the Oracle Virtual Cloud Network, we simply get no response and se no traffic going over the tunnel.

Effectively we have created static routing rules for the 2 public CIDR routes for the cloud service, and specified the next hop as the Oracle side of the IPSEC tunnels. We've also tried with next hope set for None but the result is the same.

Anyone have any insight into sending public traffic across a VPN tunnel successfully?

[akuzhuppilly]

Hello @coltsfanatic07 

IPSec tunnel can carry any IP traffic irrespective of whether the payload contains public IPs or private IPs.

You may want to check how the routing is configured on both sides and also whether the necessary security policies are in place to allow the required traffic.

[coltsfanatic07]

Thank you @akuzhuppilly for your reply. I appreciate your patience as I have no familiarity or access to the Palo Alto equipment in use as its a customers environment.

We have to active tunnels configured. Our tunnel interfaces to not have explicit IP addresses associated to them. So, we have tried two different static routes. The first, is using the CIDR as the destination, leveraging the tunnel interfaces, and then setting the next hop to "none". We also attempting to do the same, but set the next hop to the explicit IP Address of the peers tunnel IP address. Do either of those approaches seem correct?

I've analyzed the OCI rules and they suggest they are configured appropriate for security and routing for on prem traffic to leverage the gateway appliance to access the appropriate CIDR. The only other caveat that comes to mind is that OCI Site-to-Site VPN uses Asymmetric Routing by default. As previously mentioned we see no problem with ICMP traffic so I don't think that is an issue. The source traffic is also not being NAT'ed, so that was another one of my concerns from a security perspective on the remote side.

[akuzhuppilly · Accepted solution]

Hello @coltsfanatic07 

PaloAlto firewall provides route-based VPN compared to the legacy ASA firewalls which provide policy-based VPN (e.g., Access List to match the traffic).

The routing in the PaloAlto firewall for the affected CIDR traffic should be as below:
destination = CIDR

interface = IPSec tunnel interface

next hop = None

The above routing is sufficient to route the traffic to the IPSec tunnel, given that necessary security policies are in place to allow the traffic.

If the remote side is a policy-based VPN, then you may need to add the required proxy-IDs in the IPSec tunnel configuration.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUFCA0

[coltsfanatic07]

This is great @akuzhuppilly. It confirms what I thought I researched. So we do have static routing on the remote peer to allow all of the network CIDRs through. Its possible there are some additional security rules that are somehow not allowing it, but confirming the static routes on the PaloAlto side is great.

I'll accept your answer. Can you tell me if PAN > 8 has any issues with asymmetric routing at all? Also, given that we configure the static route, are there any other security settings on the PaloAlto side that would still block the traffic potentially?

[akuzhuppilly]

Hello @coltsfanatic07 

Asymmetric routing can occasionally lead to dropped traffic due to firewall settings. To determine if packet drops are occurring, consider performing a packet capture. You can refer to the following link for assistance:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSHCA0

If you suspect that the Palo Alto Firewall might be dropping valid traffic, the recommended approach is to conduct a packet capture and review the global counters. This will provide a clearer understanding of the situation. For guidance, you can visit:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloNCAS

[coltsfanatic07]

Awesome. Thanks again for all of your help.