How to integrate AWS VPN with Palo Alto Networks firewall

There are simply two ways to configure VPN to AWS VPN. Either you can copy and paste the downloaded configuration from CLI or use GUI to make changes. Copy/Paste is kind of simple process also you might miss opportunities to acknowledge a bit unique configuration so that I am going to explain in GUI mode.

Make sure that you downloaded the PAN OS configuration file and I am going to use PANOS 7.0+.

download configuration

 

  1. go to PANOS > Network > Network Profiles > IKE Crypto

    crypto

  2. check the downloaded configuration file (it is around line 33-39)

    AWScrypto

  3. add IKE Crypto Profile from PANOS

    IKECryptoconf

  4. check the gateway configuration from AWS downloaded file (it is between line 44-51). Make sure that the interface is outbound network connecting to AWS VPN.

    ikeGateway

  5. add IKE Gateway Profile accordingly.

    IKEGatewayconf1

    IKEGatewayconf2

  6. Check the IPSec Crypto from AWS downloaded file (it is in line 62-66)

    IPSecCrypto

  7. Make changes on IPSec Crypto Profile accordingly.

    IPSecCryptoconf

  8. Now it is time to setup tunnel interface. Check the AWS downloaded file (it is in line 87-90)

    Tunnel

  9. Create a tunnel under Network > Interfaces > Tunnel. Make sure that you setup default Virtual Router.

    tunnelconf1

    Tunnel2

    tunnel3

  10. It is final setup to configure IPSec Tunnel. Please make sure you change the Virtual Router accordingly.

    IPSecTunnel

  11. Apply the configuration on PANOS.

    IPSecTunnel

  12. Make sure you configure Proxy IDs. Local should be your internal network and Remote is AWS VPC (or Subnet) network.

    IPSecTunnelProxyIDs

  13. It is Policy Based Forwarding configuration from AWS downloaded file and it defines that anybody from the source LAN-CIDR tries to access destionation VPC-CIDR, the packet will be forwarded to tunnel.1 and its next hop is 169.*.*.*

    PBF

  14. test

    pbf1

    pfb2

    pbf3

    pbf4

That's it! Even though it is not a simple process, you will get some knowlegde concepts of VPN.

Good luck and please leave a comment if you have any question.

Tags