IPsec site to site tunnel: Palo Alto to Cisco 

I set up the tunnel in my home lab, not over the live internet, which is why public IPs weren't used for the peers. The loopback was just created as a placeholder for an internal network on one side of the VPN for testing. Thanks for the post, Keith Barker

Keith, you continue to make my life/job easier with your knowledge and book. Never stop what you are doing cuz you are doing it just perfect.

Thanks for the kind feedback! Keith

Hello Anton- Let me look into how/if that could be configured. I will add that to my list. Thanks, Keith

This is a good tutorial and I'll be setting up a site-to-site this week between a PA-3020 and ASA5510. The only part that you don't go over, which i'll have to figure out is the tunnel monitoring for 2 ISP's on each end; since i'll be setting up 4 tunnels for redundancy. In my experiance with PA, you can use whatever addresses to monitor. But with PA to Sonicwalls, you need an isolated network for the monitor so I use a random /30. I wonder how the ASA is going to treat this.

awesome video - thanks Keith

The commands are slightly different on the ASA, but other than that, yes.

Hi Keith, What about the proxy-id if on the cisco device the default route is to tunnel interface. I mean all traffic from the cisco router should go through the tunnel, even the Internet. Should I put 0.0.0.0/0 as local proxy id in PA firewall

Consulta, si quiero configurar IKEv2 con doble llave (local/remota) porque mi peer es un asa de Cisco, donde se configura la llave en el palo alto?

Awesome video.....Very informative. Do you have any tutorial video of Site -to Site VPN between Palo Alto and Juniper SRX ?

Good job Keith!!!

Very nice Video Keith! Is it possible that you could make a video where you configuring an ASA5505 for example to be used as an EasyVPN Client that is connecting to a Palo Alto? We have a lot of them at my work and I had an idea to configuring them to use our two Palo Altos instead of connecting to our two ASA5520 for better speed. Our client-ASAs has random global IP-adresses so we can't use static IPs like you do in this Site-to-Site configuration. A video like that would rule the world!

Hi keith, I want to know that in paloalto part, you have used proxy id only to creat the intresting traffic that we want to encrypt like in cisco we use ACL ? Also when do we use pfs because i haven't any video on that? Thanks.

Hi Keith. When you configured by SDM, its create a interface tunnel or used split tunnel?

Keith how about the Security Policy that needs to be configured for the tunnel to work? i dont see it here.

Hi Keith, I am tying to build an IPSec vpn between our Palo Alto PA5050 with our vendor with Cisco ISR 4300. The IPSec vpn configuration on the Cisco side is using tunnel protection IPSec profile and both configuration seems legit and acl are matching on both side. But for some reason, the palo alto system logs is showing proxy ID not matching and receive local id 0.0.0.0/0 and received remote Id 0.0.0.0/0. So phase 2 will come up but after some few seconds, it goes down. Not sure where is the issue. Can you assist?

Hi Keith would be good if you included the part about creating the 5.5.5.5 interface If seems odd that you never specify public IPs. If your making a tunnel over the internet why are the public IPs at each site used?

With that said, I'm a bit stressed out. My employer is sending me today to build a site to site VPN tunnel (using PAN firewall) for a customer and I'm hoping that it will go as smooth as you made it look here.

Does this apply regardless of whether the Palo Alto is the HQ or branch office?

Is it possible if you can share the initial config for the ASA? Thanks in advance

Can you setup a site to site IPSEC tunnel using a Palo Alto PA-500 and a Juniper SSG5?

Keith, do you touch the virtual router to specify some static route to the Cisco?? or the network is reachable by default?

Hey Keith, perhaps i missed that part, but where did you specify the preshared key on the PAN OS

nice KB Video....Thanks....

Great video , keep Loding stuff Thanks a lot

Hi Keith, mine is stuck at this state and i have verified the key to be same on both ends. what could possibly cause this.

Good one ..thanks..

If I need to add more than one network to the tunnel, would that proxy ID be the place where I'd do it?

Any one pls suggest still I am waiting. Still facing the same issues in between cisco and PA

What if the Cisco device is behind a NAT?

hi keith is it the same with an ASA site to site with palo alto??

Its partially up in PA box. Its stuck in MM_NO_STATE in cisco. any additional configuration required? Pls help anyone ...

Nice Lecture. Do u have any video of how to install vm image of palo alto. any good video. there are lot bad videos in youtube. i want easy and good video. Thanks in advance. !!!

I am not able to ping from cisco to palo alto . Anyone did it ? pls help me here