Site to Site VPN between Palo Alto and Azure, AWS and GCP

Meraki VPN Cloud Watchguard VPN Cloud Sophos VPN Cloud Sonicwall VPN Cloud Fortigate VPN Cloud Cisco VPN Cloud

Create a Palo Alto and Azure Site-to-Site IPsec VPN

AZURE CONFIGURATION

Create virtual network according to Microsoft article guideline.
Create Front End and Gateway subnets.
Create Virtual Network Gateway.
Create a local network gateway according to Azure configuration guidelines.
The next step is to create an IPSec policy including parameters and also a local network gateway connection that is to represent your IPSec connection from your Azure network to your on-premise network and Palo Alto firewall.
Install and configure Azure PowerShell modules on my local desktop device.
Launch Microsoft PowerShell and execute the following command to connect to Azure.
Using the Azure Cloud Shell interface, accessible in the Azure portal you could review your IPSec parameters.
Create virtual network gateway connection.

PALO ALTO CONFIGURATION

Configure tunnel interface, create, and assign new security zone.
Create an IKE Crypto profile with the following settings.
Create a new IKE Gateway with the following settings. Peer IP equals the IP address of the Azure connection public IP address (when received after configuration). Edit configuration later, if necessary, when received.
Configure an IKE Gateway and assign the IKE Crypto profile.
Create a new IPSec Crypto Profile with the following settings.
Create IPSec tunnel with the following settings.
No proxy ID was required for this configuration example.
Added static routes to my virtual router for both Azure Frontend and Gateway subnets.
After completing Azure and Palo Alto configuration, there is a green status for the IPsec tunnel indicating a successful connection. Additional negotiation information may be viewed from the Palo Alto System Log.

CONNECTING TO AZURE RESOURCES

After establishing a site-to-site connection to Azure network, you will be able to connect to resources that are created on Azure Frontend network.

Configuring IPsec VPN between Palo Alto Firewall and AWS

Configuration:

Create AWS Customer Gateway:

Sign in to the AWS Portal site with an administrative account.

Click Services and select VPC.

Select your VPC at Filter by VPC, this is the VPC you will use to configure IPsec VPN.

Go to VIRTUAL PRIVATE NETWORK (VPN) > Customer Gateways > Click Create Customer Gateway.

Create Customer Gateways with the following parameters:

Name: Palo Alto Firewall.
Routing: Static.
IP Address: Enter Palo Alto's WAN IP as 113.161.x.x.
Click Create Customer Gateway.

Create Virtual Private Gateway:

Go to VIRTUAL PRIVATE NETWORK > Virtual Private Gateways > Click Create Virtual Private Gateway.

Create a Virtual Private Gateway with the following parameters:

Name tag: VPG-PaloAlto Community.
ASN: Amazon default ASN.
Click Create Virtual Private Gateway.
Next, we will add the newly created Virtual Private Gateways to the VPC.

To Add select the newly created Virtual Private Gateways > click Action > Attach to VPC.

Select the VPC that we filtered at the Customer Gateways creation step and click Yes, Attach to complete.

Virtual Private Network has been successfully added to VPC.

Create Site-to-site VPN Connection:

To create VIRTUAL PRIVATE NETWORK (VPN) > Site-to-Site VPN Connection > click Create VPN Connection.

Create with the following information:

Name tag: S2S-AWS-to-PaloAlto.
Target Gateway Type: select Virtual Private Gateway.
Virtual Private Gateway *: select the Virtual Private Gateway just created in the above step.
Customer Gateway: select Existing.
Customer Gateway ID *: select the Customer Gateway just created in the previous step.
Routing Option: Static.
Static IP Prefixes: type Palo Alto's LAN subnet as 10.146.41.0/24.
Local IPv4 Network Cidr: type 10.146.41.0/24.
Remote IPv4 Network Cidr: enter AWS local network subnet as 172.31.32.0/20.
Click Create VPN Connection.

Create Route:

We need to create a static route to route the Palo Alto Firewall's subnet through the Virtual Gateway.

To create in VIRTUAL PRIVATE CLOUD > Route Tables > check existing route tables > go to Route tab > click Edit Route > click Add route.

Add:

Destination: 10.146.41.0/24.
Target: select the newly created Virtual Gateway.
Click Save changes.

Download the VPN configuration file and collect the necessary information:

After creating the VPN Connection, we will select the newly created VPN Connection and click Download Configuration.

Select the following information to download the configuration file:

Vendor: Palo Alto Networks.
Platform: PA Series.
Software: PANOS 7.0+.
Ike Version: ikev2.
Turn on the configuration file just got downloaded, we will have the following information.

IKE Crypto and IPsec Crypto of IPsec connection.
IKE Crypto.
IPsec Crypto.

Information about IPsec tunnel gateway IPsec VPN connection on Palo Alto.
IP tunnel on Palo Alto: 169.254.60.150/30.
MTU: 1427.
IP tunnel on AWS: 169.254.60.148/30.

Configure IKE Gateways.

Palo Alto Firewall:

Create Zone:

We need to create zones for VPN connections.

To create go to Network > Zones.

Click Add and create the following information:

Name: VPN
Type: Layer3
Click OK.

Click Commit and OK to save the configuration changes.

Create Address Object:

We will create the Address Object for the 2 LAN layers of the Palo Alto Firewall and AWS devices.

To create go to Object > Addresses.

Click Add and create according to the following parameters.

Palo Alto Firewall LAN:

Name: PA_LAN.
Type: IP Netmask - 10.146.41.0/24.
Click OK.

AWS LAN:
Name: AWS_LAN.
Type: IP Netmask - 172.31.32.0/20.
Click OK.

Click Commit and OK to save the configuration changes.

Create Interface Tunnel:

To create go to Network > Interface > Tunnel.

Click Add and create according to the following information:

Config tab:

Interface Name: tunnel.2
Virtual Router: None
Security Zone: VPN
Click OK.

IPv4 tab:
Click Add and enter the tunnel IP 169.254.60.150/30 that we got from the previous config file.

Advanced tab:
We enter MTU as 1427, this parameter is taken from the config file downloaded from AWS.

Click Commit to save the configuration changes

Create Virtual Routers:

To create Virtual Routers go to Network > Virtual Routers > click Add and configure according to the following information.

Tab Router Settings:

Name: VR1 Tab General: Click Add and select the vlan ports (LAN port), ethernet1/1 (internet port) and tunnel.2 (the tunnel used to connect VPN).
Tab Static Routes > IPv4

Click Add to add static routes and fill in the following information:

Name: Route_AWS_Subnet.
Destination: enter AWS LAN subnet as 172.31.32.0/20.
Interface: tunnel.2.
Next Hop: IP Address and enter the AWS tunnel IP is 169.254.60.148
Click OK twice to save.

Click Commit and OK to save the configuration changes.

Create IKE Crypto:

We will create IKE Crypto ie Phase 1 for VPN connection.

To create, go to Network > IKE Crypto click Add and create according to the following information:

Name: vpn-0009b589f526268e7-0
DH Group: group2
Encryption: aes-128-cbc
Authentication: sha1
Key Lifetime: Seconds - 28800
Click OK.

Click Commit and OK to save the configuration changes.

Create IPsec Crypto:

To create IPsec Crypto go to Network > IPsec Crypto and click Add.

Configure according to the following parameters:

Name: IPsec-crypto-profiles IPsec-vpn-0009b589f526268e7-0
IPsec Protocol: ESP
Encryption: aes-128-cbc
Authentication: sha1
DH Group: group2
Lifetime: Seconds - 3600
Click OK.

Click Commit and OK to save the configuration changes.

Create IKE Gateways:

To create go to Network > IKE Gateways and click Add.

Based on the IKE Gateway parameters that we have from the config file downloaded from AWS.

If we use IKEv2 only mode, enter the parameters of IKEv2 only mode, if we use IKEv2 preferred mode, enter the parameters of IKEv2 preferred mode.

In this article we will use IKEv2 only mode.

Configure according to the following parameters

General:

Name: ike-vpn-0009b589f526268e7-0
Version: IKEv2 only mode
Address Type: IPv4
Interface: ethernet1/1 (Palo Alto Firewall's WAN port)
Local IP Address: None
Peer Address: Enter AWS WAN IP as 13.59.106.76
Authentication: Pre-shared Key
Pre-shared key: enter the connection password from the config file.
Confirm Pre-shared key: re-enter the connection password.
Local Identification: select IP address and enter Palo Alto Firewall's WAN IP as 113.161.x.x.
Peer Identification: select the IP address and enter the AWS WAN IP as 13.59.106.76.

Advanced Options:
IKE Crypto Profile: select vpn-0009b589f526268e7-0.
Click OK.

Click Commit and OK to save the configuration changes.

Create IPsec Tunnels:

Now we will start creating a VPN connection with AWS.

To create go to Network > IPsec Tunnels and click Add.

Create with the following information:

Tab General:
Name: ipsec-tunnel-1
Tunnel Interface: tunnel.2
Type: Auto Key
Address Type: IPv4
IKE Gateways: ike-vpn-0009b589f526268e7-0
IPsec Crypto Profile: IPsec-vpn-0009b589f526268e7-0
Tab Proxy IDs:

Click Add and configure the following information:
Proxy ID: Proxy-1
Local: 10.146.41.0/24
Remote: 172.31.32.0/20
Protocol: Any
Click ok twice to save.

Click Commit and OK to save the configuration changes.

Create Policy:

We need to create a policy that allows traffic from Palo Alto Firewall's LAN subnet to pass through AWS's LAN subnet and vice versa.

To create a policy go to Policies > Security and click Add.

Create a policy that allows traffic from the Palo Alto Firewall's LAN subnet to pass through the AWS LAN subnet with the following information:

Tab General:

Name: LAN_TO_VPN
Rule Type: universal (default)

Tab Source:
Source Zone: click Add and select Trust-Layer3 zone
Source Address: click Add and select PA_LAN

Tab Destination:
Destination Zone: VPN
Destination Address: AWS_LAN

Tab Action:
Action: select Allow
Click OK

Next, we will click Add and create a policy that allows traffic to go from the AWS LAN subnet to the Palo Alto Firewall's LAN subnet with the following information:

Tab General:
Name: VPN_TO_LAN
Rule Type: universal (default)

Tab Source:
Source Zone: click Add and select VPN zone
Source Address: click Add and select AWS_LAN

Tab Destination:
Destination Zone: Trust_Layer3
Destination Address: PA_LAN

Tab Action:
Action: select Allow.
Click OK.

Click Commit and OK to save the configuration changes.

Result:

Go to AWS portal > Virtual Private Network (VPN) > Site-to-Site VPN Connections.

At VPN Connection > Tunnel Details > make sure the tunnel's status is UP.

Test the connection.

Ping result from linux server to Palo Alto Firewall's LAN IP machine.

Successful ping result.

Check the log by going to Monitor > Logs > Traffic, we will see the traffic going from source ip 172.31.42.255 to destination source 10,146.41.1.

Conversely, ping from the Palo Alto Firewall's LAN to the Linux server at AWS.

Successful ping result.