PAN-OS · VPN

PAN-OS-style: a route-based IPsec tunnel

On an ASA, a crypto access list picks what goes in a tunnel. Here a tunnel is an interface. Traffic goes through it because a route says so, and the interface sits in a zone, so a security rule has to allow traffic into and out of that zone. There are two things to forget, and each fails differently.

Palo Alto PAN-OS-style track · Palo Alto PAN-OS-style, Cisco router · 5 objectives

Open in simulator More Palo Alto PAN-OS-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On both firewalls: tunnel.1 in zone vpn and the virtual router, an IKE crypto profile (aes-256-cbc, sha256, group14) and an IPsec crypto profile (aes-256-cbc, sha256). The Network > IPSec Tunnels wizard sends all of this.
FWA: IKE gateway to peer 198.51.100.1 on ethernet1/2, key LABKEY, and tunnel T1. FWB: the same to peer 203.0.113.1.
A route on each to the other’s LAN through tunnel.1: 192.168.2.0/24 on FWA, 192.168.1.0/24 on FWB.
Rules on each: VPN-OUT from trust to vpn, and VPN-IN from vpn to trust. Commit on both.
PCA reaches PCB, and show vpn flow on FWA shows packets both ways.

Start this lab