{"id":32137,"date":"2019-10-31T21:45:21","date_gmt":"2019-10-31T18:45:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks\/"},"modified":"2019-10-31T21:45:21","modified_gmt":"2019-10-31T18:45:21","slug":"nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks","title":{"rendered":"Setting up IPSec Site-to-Site VPN on Palo Alto Networks equipment","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Setting
\n
\nThis article is a continuation of the previous material<\/a><\/noindex>, dedicated to the specifics of configuring equipment Palo Alto Networks <\/b>. Here we want to discuss the configuration of IPSec Site-to-Site VPN<\/b> on the equipment Palo Alto Networks<\/b> and a possible configuration option for connecting multiple Internet providers.
\n<\/a><\/noindex>
\nTo demonstrate, a standard scheme for connecting the head office to the branch will be used. To ensure a fault-tolerant Internet connection, the head office utilizes simultaneous connections with two providers: ISP-1 and ISP-2. The branch is connected to a single provider, ISP-3. Two tunnels are established between firewalls PA-1 and PA-2. The tunnels operate in Active-Standby<\/b>, with Tunnel-1 active, and Tunnel-2 will start transmitting traffic upon the failure of Tunnel-1. Tunnel-1 uses the connection to Internet provider ISP-1, while Tunnel-2 uses the connection to Internet provider ISP-2. All IP addresses are randomly generated for demonstration purposes and do not relate to reality.<\/p>\n

\"Setting
\n
\nTo build the Site-to-Site VPN, the IPSec<\/b> set of protocols for securing data transmitted over IP will be used. IPSec <\/b>It will operate using the security protocol ESP <\/b>(Encapsulating Security Payload), which will ensure the encryption of transmitted data.<\/p>\n

In IPSec <\/b>includes IKE <\/b>(Internet Key Exchange) is the protocol responsible for negotiating SA (security associations), the security parameters used to protect transmitted data. PAN firewalls support IKEv1 <\/b>and IKEv2<\/b>.<\/p>\n

In IKEv1 <\/b>The VPN connection is built in two phases: IKEv1 Phase 1 <\/b>(IKE tunnel) and IKEv1 Phase 2<\/b> (IPSec tunnel), thus creating two tunnels, one of which is used for exchanging control information between the firewalls, while the other is for traffic transmission. In IKEv1 Phase 1<\/b> there are two operational modes\u2014main mode and aggressive mode. Aggressive mode uses fewer messages and operates faster, but does not support Peer Identity Protection.<\/p>\n

IKEv2 <\/b>replaced it, and compared to IKEv1<\/b>, its main advantage is lower bandwidth requirements and faster SA negotiation. In IKEv1<\/b> fewer control messages are used (only 4), the EAP protocol is supported, MOBIKE is included, and a mechanism for checking the availability of the peer with which the tunnel is created\u2014 IKEv2<\/b> Liveness Check , replacing Dead Peer Detection in IKEv1. If the check fails, then<\/b>, replacing Dead Peer Detection in IKEv1. If the check fails, then IKEv2 <\/b>can drop the tunnel and then automatically restore it at the first opportunity. More details about the differences can be read here<\/a><\/noindex>.<\/p>\n

If the tunnel is established between firewalls from different manufacturers, there may be bugs in the implementation IKEv2<\/b>, and for compatibility with such equipment, there is an option to use IKEv1<\/b>. In other cases, it is better to use IKEv2<\/b>.<\/p>\n

Configuration steps:<\/p>\n

\u2022 Configuring two internet providers in ActiveStandby mode<\/b><\/p>\n

There are several ways to implement this function. One of them involves using the mechanism of Path Monitoring<\/b>, which became available starting with version PAN-OS 8.0.0<\/b>. In this example, version 8.0.16 is used. This function is similar to IP SLA in Cisco routers. The static default route parameter is configured to send ping packets to a specific IP address from a specified source address. In this case, the ethernet1\/1 interface pings the default gateway once per second. If there are no responses for three consecutive pings, the route is considered non-functional and is removed from the routing table. A similar route is configured towards the second internet provider, but with a higher metric (it is a backup). As soon as the first route is removed from the table, the firewall will start sending traffic through the second route \u2014 Fail-Over<\/b>. When the first provider starts responding to pings, its route will return to the table and replace the second one due to the better metric \u2014 Fail-Back<\/b>. The process Fail-Over<\/b> takes a few seconds depending on the configured intervals, but, in any case, the process is not instantaneous, and during this time traffic is lost. Fail-Back<\/b> occurs without traffic loss. It is possible to make Fail-Over<\/b> faster, with the help of BFD<\/b>, if the internet provider provides such an opportunity. BFD <\/b>is supported starting from the model PA-3000 Series<\/b> and VM-100<\/b>. As an address for pinging, it is better to specify a public, always accessible internet address rather than the provider\u2019s gateway.<\/p>\n

\"Setting
\n
\n\u2022 Creating a tunnel interface<\/b><\/p>\n

Traffic inside the tunnel is transmitted through special virtual interfaces. Each of them must be configured with an IP address from the transit network. In this example, subnet 172.16.1.0\/30 will be used for Tunnel-1, and subnet 172.16.2.0\/30 for Tunnel-2.
\nThe tunnel interface is created in the section Network -> Interfaces -> Tunnel<\/b>You need to specify a virtual router and a security zone, as well as an IP address from the corresponding transport network. The interface number can be any.<\/p>\n

\"Setting
\n
\n\"Setting
\n
\nIn the section Advanced <\/b>you can specify Management Profile<\/b>, which will allow pinging this interface; this can be useful for testing.<\/p>\n

\"Setting
\n
\n\u2022 Configuring IKE Profile<\/b><\/p>\n

IKE Profile<\/b> is responsible for the first phase of establishing a VPN connection where tunnel parameters are specified. IKE Phase 1<\/b>. The profile is created in the section Network -> Network Profiles -> IKE Crypto<\/b>. You need to specify the encryption algorithm, hashing algorithm, Diffie-Hellman group, and key lifetime. Generally, the more complex the algorithms, the worse the performance, so they should be selected based on specific security requirements. However, it is strongly discouraged to apply a Diffie-Hellman group lower than 14 for protecting sensitive information. This is due to protocol vulnerabilities that can only be mitigated by using 2048-bit modules or higher, or elliptic curve cryptography algorithms used in groups 19, 20, 21, 24. These algorithms offer better performance compared to traditional cryptography. Learn more here<\/a><\/noindex>. And here<\/a><\/noindex>.<\/p>\n

\"Setting
\n
\n\u2022 Configuring IPSec Profile<\/b><\/p>\n

The second phase of establishing a VPN connection is the IPSec tunnel. The SA parameters for it are configured in Network -> Network Profiles -> IPSec Crypto Profile<\/b>. Here you need to specify the IPSec protocol \u2014 AH <\/b>or ESP<\/b>, as well as the parameters SA <\/b> \u2014 hashing algorithms, encryption algorithms, Diffie-Hellman groups, and key lifetime. The SA parameters in IKE Crypto Profile and IPSec Crypto Profile may not match.<\/p>\n

\"Setting
\n
\n\u2022 Configuring IKE Gateway<\/b><\/p>\n

IKE Gateway<\/b> is an object representing the router or firewall with which the VPN tunnel is established. For each tunnel, you need to create a separate one IKE Gateway<\/b>. In this case, two tunnels are created, one through each Internet provider. The corresponding outgoing interface and its IP address, the peer IP address, and the shared key are specified. As an alternative to the shared key, certificates can be used.<\/p>\n

\"Setting
\n
\nHere you specify the previously created IKE Crypto Profile<\/b>. The parameters of the second object IKE Gateway<\/b> are similar, except for the IP addresses. If the Palo Alto Networks firewall is located behind a NAT router, the mechanism must be enabled. NAT Traversal<\/b>.<\/p>\n

\"Setting
\n
\n\u2022 Configuring IPSec Tunnel<\/b><\/p>\n

IPSec Tunnel<\/b> \u2014 this is an object that specifies the parameters of the IPSec tunnel, as the name suggests. You need to indicate the tunnel interface and previously created objects here. IKE Gateway<\/b>, IPSec Crypto Profile<\/b>. To enable automatic routing failover to the backup tunnel, you need to enable Tunnel Monitor<\/b>. This is a mechanism that checks if the peer is alive using ICMP traffic. You must specify the IP address of the tunnel interface of the peer with which the tunnel is being built as the destination address. The profile includes timers and actions upon loss of connection. Wait Recover<\/b> \u2013 wait until the connection is restored, Fail Over<\/b> \u2014 send traffic via another route if one exists. The configuration of the second tunnel is exactly the same, specifying the second tunnel interface and IKE Gateway.<\/p>\n

\"Setting
\n
\n\"Setting
\n
\n\u2022 Routing Configuration<\/b><\/p>\n

In this example, static routing is used. On the PA-1 firewall, in addition to two default routes, two routes to the subnet 10.10.10.0\/24 in the branch must be specified. One route uses Tunnel-1, the other Tunnel-2. The route through Tunnel-1 is primary since it has a lower metric. The mechanism Path Monitoring<\/b> for these routes is not in use. Failover is handled by Tunnel Monitor<\/b>.<\/p>\n

\"Setting
\n
\nSimilar routes for the subnet 192.168.30.0\/24 need to be configured on PA-2.<\/p>\n

\"Setting
\n
\n\u2022 Network Rules Configuration<\/b><\/p>\n

Three rules are needed for the tunnel to function:<\/p>\n

    \n
  1. For operation Path Monitor<\/b> allow ICMP on the external interfaces.<\/li>\n
  2. For IPSec <\/b>allow applications ike <\/b>and ipsec <\/b>on the external interfaces.<\/li>\n
  3. Allow traffic between internal subnets and tunnel interfaces.<\/li>\n<\/ol>\n

    \n\"Setting
    \n
    \nConclusion<\/b><\/p>\n

    This article discusses the configuration option for a resilient internet connection and Site-to-Site VPN<\/b>. We hope the information was useful and that the reader gained insight into the technologies used in Palo Alto Networks<\/b>. If you have questions about the configuration or suggestions for future article topics, please write them in the comments; we will be happy to respond.
    \n
    Source:     habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0414\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0433\u043e \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044f\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f Palo Alto Networks . \u0417\u0434\u0435\u0441\u044c \u043c\u044b \u0445\u043e\u0442\u0438\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 IPSec Site-to-Site VPN \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0438 Palo Alto Networks \u0438 \u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u043c \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0435 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432. \u0414\u043b\u044f \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u0430\u044f \u0441\u0445\u0435\u043c\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0433\u043e\u043b\u043e\u0432\u043d\u043e\u0433\u043e \u043e\u0444\u0438\u0441\u0430 \u043a \u0444\u0438\u043b\u0438\u0430\u043b\u0443. \u0414\u043b\u044f \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u043e\u0442\u043a\u0430\u0437\u043e\u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435, \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23973,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32137","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Configuring IPSec Site-to-Site VPN on Palo Alto Networks Equipment | ProHoster","description":"This article.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 IPSec Site-to-Site VPN \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0438 Palo Alto Networks | ProHoster","og:description":"\u0414\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:45:21+00:00","article:modified_time":"2019-10-31T18:45:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32137","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 09:27:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:04:40","updated":"2026-01-21 09:27:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/32137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=32137"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/32137\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/23973"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=32137"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=32137"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=32137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}