Palo Alto Policy-based Site to Site VPN with NAT [2024]

In this video we'll configure together a Policy-Based Site to Site VPN with Network Address Translation (NAT) on the Palo Alto Networks firewalls.
As a disclaimer, I personally prefer configuring route-based instead of policy-based VPN, if I have the choice. Sometimes, though, it's just technically not possible, there are times that your partner's device on the other side of the tunnel doesn't support route-based VPN.
🌐 Useful Links
- Route-based VPN and detailed description of site2site VPN: • Palo Alto VPN - Site t...
- Palo Alto Training (preparation for PCNSA): netsums.com/tr...
- NETSums Resources: netsums.com/re...
👍 Like, Share, and Subscribe for More:
If you find this tutorial helpful, don't forget to give it a thumbs up, share it with your colleagues, and subscribe to our channel for more in-depth tutorials on network security and technology best practices.
🔗 Connect with Us:
If you have questions, suggestions, or any kind of feedback, please don't hesitate to comment below! We will reply as soon as possible.
#PaloAlto #NetworkSecurity #Tutorial #itsecurity #IdentityManagement #paloaltofirewall #paloaltonetworks #firewall

[@Leokev123]

Thanks for the video. If i dont want to NAT my local devices. So example, your ubuntu server is 10.0.1.17, i will just put 10.0.1.0/24 in the local ID under proxy ID right?

[@kalibygomes3443]

Excelente vídeo, muito obrigado!!!

[@netsums]

Um abraço!

[@bhaiyaaradhya9072]

@NETSums Please upload a video regarding BGP over IPSec tunnel.

[@netsums]

It's a good idea, we haven't done a video with dynamic routing so far. Thank you for the suggestion!

[@shakarchy]

thank you so much; you are all the time bring new ways and knowledge for security and best practices together; I have a question, can we in site to the site allow one site to use the other site's internet, same as if we do a tunnel in GP and add the remote user to outside nat?

[@netsums]

Thank you for the comment! Yes, it's possible, you just need to configure the routing to send the internet traffic through the tunnel. If you're using policy based vpn, you need to configure the proxy ids accordingly.
I hope I could help.

[@fantasycuber5056]

Great video as always
Could you also do a video on how to troubleshoot VPNs

[@netsums]

Hi. I will keep it in mind

[@bhaiyaaradhya9072]

@NETSums Please upload a video configuring Zone Protection.

[@hanamynetwork]

Thank you for the video.
I have an issue. I cannot ping the subnet on the other ipsec site. Currently I enabled the NAT Traversal because my internet connection is behind a rounter. My PA is using DHCP for the WAN connection. Do you have any solution where should I look to make it work?

[@netsums]

Is the VPN connection coming up? If yes, do you see the pings in the Traffic Tab (Monitor) on the remote firewall? Is one firewall configured as passive (because of DHCP)? If yes, this firewall won't be able to start a S2S connection.
If you see the pings on the remote firewall, try capturing the packets there to see if the firewall receives an answer from the pings.

[@sidalpha2000]

GP having ipv6 issues, can you do a video

[@netsums]

Do you mean GlobalProtect? Just asking, because this video was not about GlobalProtect. :-)
I will keep that in mind.