Agenda · Agenda . SITE TO SITE VPN TOPOLOGY. 1. Create L3 VPN zone on PA1-HQ Network>Zones>Add. 2....
21
1. Create L3 VPN zone on PA1-HQ 2. Create Object of Tunnel IP address 3. Create Tunnel Interface & assign VPN zone, Virtual Router & Tunnel IP address 4. Create Phase-I policy 5. Create Phase-II policy 6. Create IPsec Tunnel 7. Add Static Route for interesting Traffic passing through Tunnel 8. PA2-BRANCH Configuration 9. Verifications Agenda
Transcript of Agenda · Agenda . SITE TO SITE VPN TOPOLOGY. 1. Create L3 VPN zone on PA1-HQ Network>Zones>Add. 2....
1. Create L3 VPN zone on PA1-HQ2. Create Object of Tunnel IP address3. Create Tunnel Interface & assign VPN zone, Virtual Router & Tunnel IP address4. Create Phase-I policy 5. Create Phase-II policy6. Create IPsec Tunnel7. Add Static Route for interesting Traffic passing through Tunnel8. PA2-BRANCH Configuration9. Verifications
Agenda
SITE TO SITE VPN TOPOLOGY
1. Create L3 VPN zone on PA1-HQ
Network>Zones>Add
2. Create Object of Tunnel IP addressObject>Addresses>Add
3. Create Tunnel Interface & assign VPN zone, Virtual Router & Tunnel IP address
Network>Interfaces>Tunnel>Add
4. Create Phase-I policy
Note:- To configure Phase-1 ParametersIKE Crypto & IKE Gateway is required
Network> Network Profiles> IKE Crypto>Add
Phase-1 policy continued Network> Network Profiles> IKE Gateways>Add
5. Create Phase-2 policy
Network> Network Profiles> IPSec Crypto>Add
6. Create IPsec Tunnel
Network> IPSec Tunnels> Add
7. Add Static Route for interesting Traffic passing through Tunnel
Commit all the changes
8. PA2-BRANCH CONFIGURATIONNow exactly same mirroring we need on Branch Firewall with changes of destination IP address onlyPrerequisite• Configure MGMT Interface • Configure LAN & WAN interfaces with all parameters • Check connectivity between WAN interface of PA2- Branch & PA1-HQ
A. Create L3 VPN zone on PA2-BR
Network>Zones>Add
B. Create Object of Tunnel IP addressObject>Addresses>Add
C. Create Tunnel Interface & assign VPN zone, Virtual Router & Tunnel IP address
D. Create Phase-I policy
Note:- To configure Phase-1 ParametersIKE Crypto & IKE Gateway is required
Network> Network Profiles> IKE Crypto>Add
Phase-1 policy continued Network> Network Profiles> IKE Gateways>Add
E. Create Phase-2 policy
Network> Network Profiles> IPSec Crypto>Add
F. Create IPsec Tunnel
Network> IPSec Tunnels> Add
7. Add Static Route for interesting Traffic passing through Tunnel
I. Add Default Route towards Outside network II. Add route for 10.11.11.0/24 through tunnel GW as 10.30.30.1
Commit all the changes
Verifications
Tunnel is up indicated by green indications
Phase-1 tunnel CLI verification
Verifications
Phase-2 tunnel CLI verification
