1. Create L3 VPN zone on PA1-HQ2. Create Object of Tunnel IP address3. Create Tunnel Interface & assign VPN zone, Virtual Router & Tunnel IP address4. Create Phase-I policy 5. Create Phase-II policy6. Create IPsec Tunnel7. Add Static Route for interesting Traffic passing through Tunnel8. PA2-BRANCH Configuration9. Verifications

Agenda

SITE TO SITE VPN TOPOLOGY

1. Create L3 VPN zone on PA1-HQ

Network>Zones>Add

2. Create Object of Tunnel IP addressObject>Addresses>Add

3. Create Tunnel Interface & assign VPN zone, Virtual Router & Tunnel IP address

Network>Interfaces>Tunnel>Add

4. Create Phase-I policy

Note:- To configure Phase-1 ParametersIKE Crypto & IKE Gateway is required

Network> Network Profiles> IKE Crypto>Add

Phase-1 policy continued Network> Network Profiles> IKE Gateways>Add

5. Create Phase-2 policy

Network> Network Profiles> IPSec Crypto>Add

6. Create IPsec Tunnel

Network> IPSec Tunnels> Add

7. Add Static Route for interesting Traffic passing through Tunnel

Commit all the changes

8. PA2-BRANCH CONFIGURATIONNow exactly same mirroring we need on Branch Firewall with changes of destination IP address onlyPrerequisite• Configure MGMT Interface • Configure LAN & WAN interfaces with all parameters • Check connectivity between WAN interface of PA2- Branch & PA1-HQ

A. Create L3 VPN zone on PA2-BR

Network>Zones>Add

B. Create Object of Tunnel IP addressObject>Addresses>Add

C. Create Tunnel Interface & assign VPN zone, Virtual Router & Tunnel IP address

D. Create Phase-I policy

Note:- To configure Phase-1 ParametersIKE Crypto & IKE Gateway is required

Network> Network Profiles> IKE Crypto>Add

Phase-1 policy continued Network> Network Profiles> IKE Gateways>Add

E. Create Phase-2 policy

Network> Network Profiles> IPSec Crypto>Add

F. Create IPsec Tunnel

Network> IPSec Tunnels> Add

7. Add Static Route for interesting Traffic passing through Tunnel

I. Add Default Route towards Outside network II. Add route for 10.11.11.0/24 through tunnel GW as 10.30.30.1

Commit all the changes

Verifications

Tunnel is up indicated by green indications

Phase-1 tunnel CLI verification

Verifications

Phase-2 tunnel CLI verification