{"id":4447,"date":"2022-11-18T08:41:44","date_gmt":"2022-11-18T16:41:44","guid":{"rendered":"https:\/\/SUMMALAI.COM\/?p=4447"},"modified":"2022-11-23T14:27:12","modified_gmt":"2022-11-23T22:27:12","slug":"how-to-set-up-site-to-site-vpn-on-palo-alto-with-nordlayer","status":"publish","type":"post","link":"https:\/\/SUMMALAI.COM\/?p=4447","title":{"rendered":"How to Set Up Site-to-Site VPN on Palo Alto with NordLayer"},"content":{"rendered":"\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p><strong>Note<\/strong>: If your device\/service supports SHA256 and DH group 14, it is recommended to use these settings instead.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"configuring-the-tunnel-in-the-palo-alto-webgui\">Configuring the tunnel in the Palo Alto WebGUI<\/h2>\n\n\n\n<ol class=\"wp-block-list\"><li>Open the Palo Alto WebGUI, and select the Network tab<\/li><li>Select Interfaces and open the Tunnel tab<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.document360.io\/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16\/Images\/Documentation\/01%20Configuring%20the%20tunnel%20in%20the%20Palo%20Alto%20WebGUI.png\" alt=\"01 Configuring the tunnel in the Palo Alto WebGUI.png\"\/><\/figure>\n\n\n\n<ol class=\"wp-block-list\" start=\"3\"><li>Click Add<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.document360.io\/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16\/Images\/Documentation\/02%20Configuring%20the%20tunnel%20in%20the%20Palo%20Alto%20WebGUI.png\" alt=\"02 Configuring the tunnel in the Palo Alto WebGUI.png\"\/><\/figure>\n\n\n\n<ol class=\"wp-block-list\" start=\"4\"><li>Assign the parameters with the following information<\/li><\/ol>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Virtual Router<\/strong>: Select the virtual router you would like your tunnel interface to reside in.<\/li><li><strong>Security Zone<\/strong>: Configure a new zone for the tunnel interface for more granular control of traffic ingress\/egressing the tunnel. If the tunnel interface is in a zone different from the zone where the traffic will originate or depart, then a policy is required to allow the traffic to flow from the source zone to the zone containing the tunnel interface.<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.document360.io\/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16\/Images\/Documentation\/03%20Configuring%20the%20tunnel%20in%20the%20Palo%20Alto%20WebGUI.png\" alt=\"03 Configuring the tunnel in the Palo Alto WebGUI.png\"\/><\/figure>\n\n\n\n<ol class=\"wp-block-list\" start=\"5\"><li>Open the Network tab<\/li><li>Select Network Profiles and go to IKE Crypto<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.document360.io\/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16\/Images\/Documentation\/04%20Configuring%20the%20tunnel%20in%20the%20Palo%20Alto%20WebGUI.png\" alt=\"04 Configuring the tunnel in the Palo Alto WebGUI.png\"\/><\/figure>\n\n\n\n<ol class=\"wp-block-list\" start=\"7\"><li>Click Add (at the bottom of the page) and define the IKE Crypto profile (IKEv1 Phase-1) parameters<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.document360.io\/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16\/Images\/Documentation\/05%20Configuring%20the%20tunnel%20in%20the%20Palo%20Alto%20WebGUI.png\" alt=\"05 Configuring the tunnel in the Palo Alto WebGUI.png\"\/><\/figure>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Name<\/strong>: Choose the name of your own choice.<\/li><li><strong>DH Group<\/strong>: 14<\/li><li><strong>Encryption<\/strong>: aes-256-cbc<\/li><li><strong>Authentication<\/strong>: sha256<\/li><li><strong>Key Lifetime<\/strong>: 1 Hour<\/li><li><strong>IKEv2 Authentication Multiple<\/strong>: 0<\/li><\/ul>\n\n\n\n<ol class=\"wp-block-list\" start=\"8\"><li>Open the Network tab. Select Network Profiles and go to IKE Gateway<\/li><li>Select Add and fill in the following information:<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.document360.io\/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16\/Images\/Documentation\/06%20Configuring%20the%20tunnel%20in%20the%20Palo%20Alto%20WebGUI.png\" alt=\"06 Configuring the tunnel in the Palo Alto WebGUI.png\"\/><\/figure>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Name<\/strong>: Choose the name of your own choice<\/li><li><strong>Version<\/strong>: IKEv1 (IKEv2 recommended)<\/li><li><strong>Address Type<\/strong>: IPv4<\/li><li><strong>Interface<\/strong>: The external interface connected to the internet<\/li><li><strong>Local IP Address<\/strong>: Choose the external IP address<\/li><li><strong>Peer IP Address Type<\/strong>: IP<\/li><li><strong>Peer Address<\/strong>: the IP of your NordLayer dedicated server<\/li><li><strong>Authentication<\/strong>: Pre-Shared Key<\/li><li><strong>Pre-Shared Key<\/strong>: Enter a string of your own choice containing lower-case characters, upper-case characters, and a number. Please write down this value as we will also need this value on our end.<\/li><li><strong>Local Identification<\/strong>: None (the gateway will use the local IP as the local identification value)<\/li><li><strong>Peer Identification<\/strong>: None (the gateway will use the peer IP as the peer identification value)<\/li><\/ul>\n\n\n\n<ol class=\"wp-block-list\" start=\"10\"><li>Open the Network tab. Select Network Profiles and go to IPSec Crypto<\/li><li>Select Add and fill in the following information:<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.document360.io\/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16\/Images\/Documentation\/07%20Configuring%20the%20tunnel%20in%20the%20Palo%20Alto%20WebGUI.png\" alt=\"07 Configuring the tunnel in the Palo Alto WebGUI.png\"\/><\/figure>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Name<\/strong>: NordLayer-Phase2<\/li><li><strong>IPSec Protocol<\/strong>: ESP<\/li><li><strong>DH Group<\/strong>: 14<\/li><li><strong>Encryption<\/strong>: aes-256-cbc<\/li><li><strong>Lifetime<\/strong>: 8 Hours<\/li><li><strong>Authentication<\/strong>: sha256<\/li><\/ul>\n\n\n\n<ol class=\"wp-block-list\" start=\"12\"><li>Open the Network tab. Select IPSec Tunnels, then Add and fill in the following information:<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.document360.io\/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16\/Images\/Documentation\/08%20Configuring%20the%20tunnel%20in%20the%20Palo%20Alto%20WebGUI.png\" alt=\"08 Configuring the tunnel in the Palo Alto WebGUI.png\"\/><\/figure>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Name<\/strong>: Choose the name of your own choice<\/li><li><strong>Tunnel Interface<\/strong>: Choose the appropriate interface<\/li><li><strong>Type<\/strong>: Auto Key<\/li><li><strong>Address Type<\/strong>: IPv4<\/li><li><strong>IKE Gateway<\/strong>: Choose the gateway that was defined earlier<\/li><li><strong>IPSec Crypto Profile<\/strong>: Choose the profile that was defined earlier<\/li><li><strong>Add Proxy IDs<\/strong>  Below, please see a sample.<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img fetchpriority=\"high\" decoding=\"async\" width=\"779\" height=\"448\" src=\"https:\/\/SUMMALAI.COM\/wp-content\/uploads\/2022\/11\/image.png\" alt=\"\" class=\"wp-image-4455\" srcset=\"https:\/\/SUMMALAI.COM\/wp-content\/uploads\/2022\/11\/image.png 779w, https:\/\/SUMMALAI.COM\/wp-content\/uploads\/2022\/11\/image-300x173.png 300w, https:\/\/SUMMALAI.COM\/wp-content\/uploads\/2022\/11\/image-768x442.png 768w\" sizes=\"(max-width: 779px) 100vw, 779px\" \/><\/figure>\n\n\n\n<ol class=\"wp-block-list\" start=\"13\"><li>Open the Network tab<\/li><li>Select Virtual Routers, then select Static Routes and click Add. Fill in the following information:<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.document360.io\/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16\/Images\/Documentation\/09%20Configuring%20the%20tunnel%20in%20the%20Palo%20Alto%20WebGUI.png\" alt=\"09 Configuring the tunnel in the Palo Alto WebGUI.png\"\/><\/figure>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Name<\/strong>: Choose the name of your own choice<\/li><li><strong>Destination<\/strong>: 10.6.0.0\/20 (if such an object does not exist yet make sure to define it)<\/li><li><strong>Interface<\/strong>: Choose the appropriate interface<\/li><li><strong>Next Hop<\/strong>: None<\/li><li><strong>Metric<\/strong>: 10<\/li><li><strong>Route Table<\/strong>: Unicast<\/li><li><strong>BFD Profile:<\/strong>&nbsp;Disable BFD<\/li><\/ul>\n\n\n\n<ol class=\"wp-block-list\" start=\"15\"><li>Open the Policies tab and select Security<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.document360.io\/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16\/Images\/Documentation\/10%20Configuring%20the%20tunnel%20in%20the%20Palo%20Alto%20WebGUI.png\" alt=\"10 Configuring the tunnel in the Palo Alto WebGUI.png\"\/><\/figure>\n\n\n\n<p>By default, IKE negotiation and IPSec\/ESP packets are allowed.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.document360.io\/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16\/Images\/Documentation\/11%20Configuring%20the%20tunnel%20in%20the%20Palo%20Alto%20WebGUI.png\" alt=\"11 Configuring the tunnel in the Palo Alto WebGUI.png\"\/><\/figure>\n\n\n\n<ol class=\"wp-block-list\" start=\"16\"><li>If you see somewhat differently or if you wish to have more granular traffic control, select ADD, and create an appropriate rule<\/li><\/ol>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"ending-note\">Ending note:<\/h2>\n\n\n\n<p>In order to finalize the site-to-site setup on our end, please provide these values via&nbsp;<a href=\"https:\/\/help.nordlayer.com\/docs\/site-to-site\">Site-to-site request from<\/a>&nbsp;in the NordLayer Control Panel:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Pre-shared key &#8211; you can generate it or we can provide it<\/li><li>Encryption&nbsp; details (AES, SHA and DH group) &#8211; AES256, SHA256 and DH group 14 are recommended (also must support IKEv2)<\/li><li>Remote gateway\/router public IP (must be reachable while connected to the dedicated server)<\/li><li>Remote subnet and mask (the subnet is used in your local network)<\/li><\/ul>\n\n\n\n<p>Ref: <a href=\"https:\/\/help.nordlayer.com\/docs\/site-to-site-palo-alto\">Setting up site-to-site on Palo Alto | Nordlayer Help<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Note: If your device\/service supports SHA256 and DH group 14, it is recommended to use these settings instead. Configuring the tunnel in the Palo Alto WebGUI Open the Palo Alto WebGUI, and select the Network tab Select Interfaces and open the Tunnel tab Click Add Assign the parameters with the following information Virtual Router: Select <a class=\"read-more\" href=\"https:\/\/SUMMALAI.COM\/?p=4447\">Read More<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[13,9,1391,569,1161],"tags":[1392,1393],"class_list":["post-4447","post","type-post","status-publish","format-standard","hentry","category-firewalls","category-networks","category-nordlayer","category-others","category-palo-alto","tag-up-site-to-site-vpn-on-palo-alto-with-nordlayer","tag-vpn-with-palo-alto-and-nordlayer"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/4447","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4447"}],"version-history":[{"count":2,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/4447\/revisions"}],"predecessor-version":[{"id":4456,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/4447\/revisions\/4456"}],"wp:attachment":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4447"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4447"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4447"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}