{"id":864,"date":"2020-09-08T16:25:55","date_gmt":"2020-09-08T08:25:55","guid":{"rendered":"https:\/\/www.insecurewire.com\/?p=864"},"modified":"2020-09-08T16:25:55","modified_gmt":"2020-09-08T08:25:55","slug":"configure-a-palo-alto-ipsec-tunnel-to-azure","status":"publish","type":"post","link":"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/","title":{"rendered":"Configuring a Palo Alto IPSec Tunnel to Microsoft Azure"},"content":{"rendered":"

I recently spent some time working out if using the NBN is a viable solution for IPSec connectivity to MS Azure here in Australia. This would be in place of the more expensive Microsoft Express Route \/ Peering.
\nOK so to demo this up I am using a Palo Alto 220 appliance on the campus edge with a 100\/40 NBN circuit (approx 70mbit of bandwidth). On the Azure side we have a standard vNet and the basic SKU<\/a> virtual network gateway which offers up to 100mbit of bandwidth and 10 IPsec tunnels.
\nSince I am in Australia I am use the Microsoft Azure Southeast zone. PA uses route based VPNs which means you point the subnets to the logical tunnel interface for routing. The concept of “Proxy ID” is essentially an ACL that allows traffic through the tunnel. On the Azure side this is called the local network gateway and both the PA and the LNG subnets need to match for succesful tunnel establishment.<\/p>\n

Below is the network diagram of this lab:
\n\"PAtoAZ\"<\/a><\/p>\n

Here are the guides I followed:
\nPalo Alto: Configuring IKEv2 IPsec VPN for Microsoft Azure Environment<\/a>
\nAzure Site to Site IPsec<\/a><\/p>\n

Some of the challenges I faced was with the configuration on the PA side:<\/strong>
\n1. Under the IKE Gateway advanced settings do not tick passive mode (If you use passive mode the PA can only respond to a IPSec initiator. Only the Azure side will be able to bring the IPSec tunnel up).
\n2. If your ISP dynamically assigns your static IP address that is fine, just leave the local IP to none and the PA will use the Interface IP address. In Australia the NBN RSPs (Retail Service Providers) use DHCP to assign a static IP address if you have paid for one (iiNet \/ TPG).<\/p>\n

Setting up the NAT to allow campus networks to access Azure vNet:<\/strong>
\nThe most difficult part is getting the NAT logic configured correctly on the PA side.
\nFor traffic from campus 10.170.0.0\/16 use DNAT rule:
\n\"DNAT<\/a>
\nAs you can see above traffic coming into the interface for campus address 10.170.13.4 is destination translated for the Azure VM 10.0.100.4
\nFor the traffic from Azure vNet 10.0.100.0\/24:
\n\"Azure<\/a>
\nIn the above example the traffic that is initated from the Azure vNet is SNAT to the interface IP of PA side.
\nFor both NATs I just used the one Azure vNet host as this was just for the demo purpose. You would nat the to the entire subnet in production.
\nOf course if you had just a single site and not a multi branch \/ campus scenario you wouldn’t need the NATs just routing and security policy to permit the tunnel traffic.<\/p>\n

In the above example I tested an Ubuntu VM (10.170.13.4 -> 10.0.100.4) running in the Azure vNet at around 50-55ms latency to Azure Southeast zone. A cost effective, viable solution for connectivity from on prem to Azure, use cases could be web server workloads or training environments. It was a rewarding learning experience on how to set it all up \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"

I recently spent some time working out if using the NBN is a viable solution for IPSec connectivity to MS Azure here in Australia. This…<\/p>\n","protected":false},"author":2,"featured_media":867,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23,5],"tags":[58,120,130,139,201],"class_list":["post-864","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","category-palo-alto-networks","tag-azure","tag-ipsec","tag-microsoft","tag-palo-alto","tag-vpn"],"acf":[],"yoast_head":"\nConfiguring a Palo Alto IPSec Tunnel to Microsoft Azure - Insecure Wire<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Configuring a Palo Alto IPSec Tunnel to Microsoft Azure - Insecure Wire\" \/>\n<meta property=\"og:description\" content=\"I recently spent some time working out if using the NBN is a viable solution for IPSec connectivity to MS Azure here in Australia. This...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/\" \/>\n<meta property=\"og:site_name\" content=\"Insecure Wire\" \/>\n<meta property=\"article:published_time\" content=\"2020-09-08T08:25:55+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/09\/PAtoAZ.png\" \/>\n\t<meta property=\"og:image:width\" content=\"2011\" \/>\n\t<meta property=\"og:image:height\" content=\"545\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"nikonau\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/insecurewire\" \/>\n<meta name=\"twitter:site\" content=\"@insecurewire\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"nikonau\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/\"},\"author\":{\"name\":\"nikonau\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d\"},\"headline\":\"Configuring a Palo Alto IPSec Tunnel to Microsoft Azure\",\"datePublished\":\"2020-09-08T08:25:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/\"},\"wordCount\":504,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.insecurewi.re\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/09\/PAtoAZ.png\",\"keywords\":[\"Azure\",\"IPSec\",\"Microsoft\",\"Palo Alto\",\"VPN\"],\"articleSection\":[\"Azure\",\"Palo Alto Networks\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/\",\"url\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/\",\"name\":\"Configuring a Palo Alto IPSec Tunnel to Microsoft Azure - Insecure Wire\",\"isPartOf\":{\"@id\":\"https:\/\/www.insecurewi.re\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/09\/PAtoAZ.png\",\"datePublished\":\"2020-09-08T08:25:55+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/#primaryimage\",\"url\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/09\/PAtoAZ.png\",\"contentUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/09\/PAtoAZ.png\",\"width\":2011,\"height\":545,\"caption\":\"PAtoAZ\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.insecurewi.re\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Configuring a Palo Alto IPSec Tunnel to Microsoft Azure\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.insecurewi.re\/#website\",\"url\":\"https:\/\/www.insecurewi.re\/\",\"name\":\"Insecure Wire\",\"description\":\"A Network Engineer\u2019s Perspective.\",\"publisher\":{\"@id\":\"https:\/\/www.insecurewi.re\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.insecurewi.re\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.insecurewi.re\/#organization\",\"name\":\"Insecure Wire\",\"url\":\"https:\/\/www.insecurewi.re\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png\",\"contentUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png\",\"width\":32,\"height\":32,\"caption\":\"Insecure Wire\"},\"image\":{\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/insecurewire\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d\",\"name\":\"nikonau\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g\",\"caption\":\"nikonau\"},\"sameAs\":[\"https:\/\/x.com\/https:\/\/twitter.com\/insecurewire\"],\"url\":\"https:\/\/www.insecurewi.re\/index.php\/author\/nikon\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Configuring a Palo Alto IPSec Tunnel to Microsoft Azure - Insecure Wire","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/","og_locale":"en_US","og_type":"article","og_title":"Configuring a Palo Alto IPSec Tunnel to Microsoft Azure - Insecure Wire","og_description":"I recently spent some time working out if using the NBN is a viable solution for IPSec connectivity to MS Azure here in Australia. This...","og_url":"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/","og_site_name":"Insecure Wire","article_published_time":"2020-09-08T08:25:55+00:00","og_image":[{"width":2011,"height":545,"url":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/09\/PAtoAZ.png","type":"image\/png"}],"author":"nikonau","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/insecurewire","twitter_site":"@insecurewire","twitter_misc":{"Written by":"nikonau","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/#article","isPartOf":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/"},"author":{"name":"nikonau","@id":"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d"},"headline":"Configuring a Palo Alto IPSec Tunnel to Microsoft Azure","datePublished":"2020-09-08T08:25:55+00:00","mainEntityOfPage":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/"},"wordCount":504,"commentCount":0,"publisher":{"@id":"https:\/\/www.insecurewi.re\/#organization"},"image":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/#primaryimage"},"thumbnailUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/09\/PAtoAZ.png","keywords":["Azure","IPSec","Microsoft","Palo Alto","VPN"],"articleSection":["Azure","Palo Alto Networks"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/","url":"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/","name":"Configuring a Palo Alto IPSec Tunnel to Microsoft Azure - Insecure Wire","isPartOf":{"@id":"https:\/\/www.insecurewi.re\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/#primaryimage"},"image":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/#primaryimage"},"thumbnailUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/09\/PAtoAZ.png","datePublished":"2020-09-08T08:25:55+00:00","breadcrumb":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/#primaryimage","url":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/09\/PAtoAZ.png","contentUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/09\/PAtoAZ.png","width":2011,"height":545,"caption":"PAtoAZ"},{"@type":"BreadcrumbList","@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/09\/08\/configure-a-palo-alto-ipsec-tunnel-to-azure\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.insecurewi.re\/"},{"@type":"ListItem","position":2,"name":"Configuring a Palo Alto IPSec Tunnel to Microsoft Azure"}]},{"@type":"WebSite","@id":"https:\/\/www.insecurewi.re\/#website","url":"https:\/\/www.insecurewi.re\/","name":"Insecure Wire","description":"A Network Engineer\u2019s Perspective.","publisher":{"@id":"https:\/\/www.insecurewi.re\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.insecurewi.re\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.insecurewi.re\/#organization","name":"Insecure Wire","url":"https:\/\/www.insecurewi.re\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/","url":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png","contentUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png","width":32,"height":32,"caption":"Insecure Wire"},"image":{"@id":"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/insecurewire"]},{"@type":"Person","@id":"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d","name":"nikonau","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.insecurewi.re\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g","caption":"nikonau"},"sameAs":["https:\/\/x.com\/https:\/\/twitter.com\/insecurewire"],"url":"https:\/\/www.insecurewi.re\/index.php\/author\/nikon\/"}]}},"_links":{"self":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/posts\/864","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/comments?post=864"}],"version-history":[{"count":0,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/posts\/864\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/media\/867"}],"wp:attachment":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/media?parent=864"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/categories?post=864"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/tags?post=864"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}