How to Configure IPSec VPN on Palo Alto Firewall

We need to configure below steps to configure S2S vpn into Paloalto

-->> Tunnel Zone

-->> Tunnel Interface

-->> IKE Crypto (phase 1)

-->> IPSec Crypto (phase 2)

-->> IKE Gateway

-->> IPSec Tunnel

-->> Routes

-->> Security Policy

Zone -- 

1- Inside- For internal traffic 

2- Outside - this connect to Internet 

3- VPN - this zone use for VPN tunnel 

 ---->> Configure Tunnel Interface <<--- 

1- Login into Webgui -->> Go into Network Tab-->> Tunnel Interface 

Interface Name: tunnel.12

Virtual Router: MY-VR

Security Zone: VPN

IPv4: 192.168.1./30

---->> IKE Crypto (phase 1) <<---

1- Go to Network >> Network Profile >> IKE Crypto and click Add

Name: Test-IKE-CRYPTO

DH Group: group5

Authentication: sha256

Encryption: aes-192-cbc

Timers (Key Lifetime): 50,000 seconds 

--->> IPSec Crypto (phase 2)<<-----

1- Go to Network >> Network Profile >> IPSec Crypto and click Add.

Name: Test-IPSEC-CRYPTO

Encryption: aes-256-cbc

Authentication: sha1

DH Group: group2

Lifetime: 10,000 seconds

----->>>  IKE Gateway<<<-----

1- Go to Network >> Network Profile >> IKE Gateway and click Add

Name: Test-IKE-GATEWAY

Version: IKEv1

Interface: ethernet1/1 (IPSec interface)

Local IP Address: 10.1.1.1/24

Peer IP Address Type: IP

Peer Address: 10.1.1.2

Authentication: Pre-Shared Key

Pre-shared Key: "Test@123"

Now click on Advanced Tab and select our IKE crypto profile.

 --->>>IPSec Tunnel---->>

1- Go to Network >> IPSec Tunnels and click Add-

Name: TEST-IPSEC

Tunnel Interface: tunnel.12

IKE Gateway: Test-IKE-GATEWAY

IPSec Crypto Profile: Test-IPSEC-CRYPTO

In this profile, we can call our both profile IKE and IPSEC on that and include the Tunel group which we created Tunnel .12

In Proxy id , we only allowed interested traffic on that like LAN IPs

--->>> Routes<<-----

Add routes to reach PA-A to PA-B and vise-versa. Below are the route from PA-A to PA-B, where the gateway is IPSec peer IP, which is 192.168.1.1

Router Name - Router

Destination IP- 10.10.10.0/24

Next Hop IP - 192.168.1.2(Gateway IPSec Peer ip)

--->> Security Policy<<---

-->>  We can use two policies for this Site to site VPN

1- IPSec 

2-  For LAN to LAN communication between peer

-->> IPSec

Source Zone: Outside

Destination Zone: Outside

Application: ike, ipsec-esp

-->> For LAN to LAN communication between peer 

Source Zone: LAN & VPN

Source IP: 172.16.0.0/24 & 10.10.10.0/24

Destination Zone: LAN & VPN

Destination IP: 172.16.0.0/24 & 10.10.10.0/24

Application: any 

-->> check Logs <<--

1 - Go into Monitor -->> logs -->> system 

--->>> Troubleshooting for Site to Site VPN <<----

# show vpn ike-sa

#show vpn ipsec-sa tunnel "tunnel name"

 #show vpn flow name "tunnel name"

# show running tunnel flow

Please command if you still face any issue.