Advanced LSVPN Configuration with iBGP
Table of Contents
Expand All
|
Collapse All
Next-Generation Firewall Docs
-
PAN-OS 10.1
- PAN-OS 11.1 & Later
- PAN-OS 11.0 (EoL)
- PAN-OS 10.2
- PAN-OS 10.1
- PAN-OS 10.0 (EoL)
- PAN-OS 9.1 (EoL)
- Cloud Management of NGFWs
-
- Management Interfaces
-
- Launch the Web Interface
- Configure Banners, Message of the Day, and Logos
- Use the Administrator Login Activity Indicators to Detect Account Misuse
- Manage and Monitor Administrative Tasks
- Commit, Validate, and Preview Firewall Configuration Changes
- Export Configuration Table Data
- Use Global Find to Search the Firewall or Panorama Management Server
- Manage Locks for Restricting Configuration Changes
-
-
- Define Access to the Web Interface Tabs
- Provide Granular Access to the Monitor Tab
- Provide Granular Access to the Policy Tab
- Provide Granular Access to the Objects Tab
- Provide Granular Access to the Network Tab
- Provide Granular Access to the Device Tab
- Define User Privacy Settings in the Admin Role Profile
- Restrict Administrator Access to Commit and Validate Functions
- Provide Granular Access to Global Settings
- Provide Granular Access to the Panorama Tab
- Provide Granular Access to Operations Settings
- Panorama Web Interface Access Privileges
-
- Reset the Firewall to Factory Default Settings
-
- Plan Your Authentication Deployment
- Pre-Logon for SAML Authentication
- Configure SAML Authentication
- Configure Kerberos Single Sign-On
- Configure Kerberos Server Authentication
- Configure TACACS+ Authentication
- Configure RADIUS Authentication
- Configure LDAP Authentication
- Configure Local Database Authentication
- Configure an Authentication Profile and Sequence
- Test Authentication Server Connectivity
- Troubleshoot Authentication Issues
-
- Keys and Certificates
- Default Trusted Certificate Authorities (CAs)
- Certificate Deployment
- Configure the Master Key
- Export a Certificate and Private Key
- Configure a Certificate Profile
- Configure an SSL/TLS Service Profile
- Configure an SSH Service Profile
- Replace the Certificate for Inbound Management Traffic
- Configure the Key Size for SSL Forward Proxy Server Certificates
-
- HA Overview
-
- Prerequisites for Active/Active HA
- Configure Active/Active HA
-
- Use Case: Configure Active/Active HA with Route-Based Redundancy
- Use Case: Configure Active/Active HA with Floating IP Addresses
- Use Case: Configure Active/Active HA with ARP Load-Sharing
- Use Case: Configure Active/Active HA with Floating IP Address Bound to Active-Primary Firewall
- Use Case: Configure Active/Active HA with Source DIPP NAT Using Floating IP Addresses
- Use Case: Configure Separate Source NAT IP Address Pools for Active/Active HA Firewalls
- Use Case: Configure Active/Active HA for ARP Load-Sharing with Destination NAT
- Use Case: Configure Active/Active HA for ARP Load-Sharing with Destination NAT in Layer 3
- HA Clustering Overview
- HA Clustering Best Practices and Provisioning
- Configure HA Clustering
- Refresh HA1 SSH Keys and Configure Key Options
- HA Firewall States
- Reference: HA Synchronization
-
- Use the Dashboard
- Monitor Applications and Threats
- Monitor Block List
-
- Report Types
- View Reports
- Configure the Expiration Period and Run Time for Reports
- Disable Predefined Reports
- Custom Reports
- Generate Custom Reports
- Generate the SaaS Application Usage Report
- Manage PDF Summary Reports
- Generate User/Group Activity Reports
- Manage Report Groups
- Schedule Reports for Email Delivery
- Manage Report Storage Capacity
- View Policy Rule Usage
- Use External Services for Monitoring
- Configure Log Forwarding
- Configure Email Alerts
-
- Configure Syslog Monitoring
-
- Traffic Log Fields
- Threat Log Fields
- URL Filtering Log Fields
- Data Filtering Log Fields
- HIP Match Log Fields
- GlobalProtect Log Fields
- IP-Tag Log Fields
- User-ID Log Fields
- Decryption Log Fields
- Tunnel Inspection Log Fields
- SCTP Log Fields
- Authentication Log Fields
- Config Log Fields
- System Log Fields
- Correlated Events Log Fields
- GTP Log Fields
- Audit Log Fields
- Syslog Severity
- Custom Log/Event Format
- Escape Sequences
- Forward Logs to an HTTP/S Destination
- Firewall Interface Identifiers in SNMP Managers and NetFlow Collectors
- Monitor Transceivers
-
- User-ID Overview
- Enable User-ID
- Map Users to Groups
- Enable User- and Group-Based Policy
- Enable Policy for Users with Multiple Accounts
- Verify the User-ID Configuration
-
- App-ID Overview
- App-ID and HTTP/2 Inspection
- Manage Custom or Unknown Applications
- Safely Enable Applications on Default Ports
- Applications with Implicit Support
-
- Prepare to Deploy App-ID Cloud Engine
- Enable or Disable the App-ID Cloud Engine
- App-ID Cloud Engine Processing and Usage
- New App Viewer (Policy Optimizer)
- Add Apps to an Application Filter with Policy Optimizer
- Add Apps to an Application Group with Policy Optimizer
- Add Apps Directly to a Rule with Policy Optimizer
- Replace an RMA Firewall (ACE)
- Impact of License Expiration or Disabling ACE
- Commit Failure Due to Cloud Content Rollback
- Troubleshoot App-ID Cloud Engine
- Application Level Gateways
- Disable the SIP Application-level Gateway (ALG)
- Maintain Custom Timeouts for Data Center Applications
-
- Decryption Overview
-
- Keys and Certificates for Decryption Policies
- SSL Forward Proxy
- SSL Forward Proxy Decryption Profile
- SSL Inbound Inspection
- SSL Inbound Inspection Decryption Profile
- SSL Protocol Settings Decryption Profile
- SSH Proxy
- SSH Proxy Decryption Profile
- Profile for No Decryption
- SSL Decryption for Elliptical Curve Cryptography (ECC) Certificates
- Perfect Forward Secrecy (PFS) Support for SSL Decryption
- SSL Decryption and Subject Alternative Names (SANs)
- TLSv1.3 Decryption
- High Availability Not Supported for Decrypted Sessions
- Decryption Mirroring
- Configure SSL Forward Proxy
- Configure SSL Inbound Inspection
- Configure SSH Proxy
- Configure Server Certificate Verification for Undecrypted Traffic
- Enable Users to Opt Out of SSL Decryption
- Temporarily Disable SSL Decryption
- Configure Decryption Port Mirroring
- Verify Decryption
- Activate Free Licenses for Decryption Features
-
- Policy Types
- Policy Objects
- Track Rules Within a Rulebase
- Enforce Policy Rule Description, Tag, and Audit Comment
- Move or Clone a Policy Rule or Object to a Different Virtual System
-
- External Dynamic List
- Built-in External Dynamic Lists
- Configure the Firewall to Access an External Dynamic List
- Retrieve an External Dynamic List from the Web Server
- View External Dynamic List Entries
- Exclude Entries from an External Dynamic List
- Enforce Policy on an External Dynamic List
- Find External Dynamic Lists That Failed Authentication
- Disable Authentication for an External Dynamic List
- Register IP Addresses and Tags Dynamically
- Use Dynamic User Groups in Policy
- Use Auto-Tagging to Automate Security Actions
- CLI Commands for Dynamic IP Addresses and Tags
- Application Override Policy
- Test Policy Rules
-
- Network Segmentation Using Zones
- How Do Zones Protect the Network?
-
PAN-OS 11.1 & Later
- PAN-OS 11.1 & Later
- PAN-OS 11.0 (EoL)
- PAN-OS 10.2
- PAN-OS 10.1
-
- Tap Interfaces
-
- Layer 2 and Layer 3 Packets over a Virtual Wire
- Port Speeds of Virtual Wire Interfaces
- LLDP over a Virtual Wire
- Aggregated Interfaces for a Virtual Wire
- Virtual Wire Support of High Availability
- Zone Protection for a Virtual Wire Interface
- VLAN-Tagged Traffic
- Virtual Wire Subinterfaces
- Configure Virtual Wires
- Configure a PPPoE Client on a Subinterface
- Configure an IPv6 PPPoE Client
- Configure an Aggregate Interface Group
- Configure Bonjour Reflector for Network Segmentation
- Use Interface Management Profiles to Restrict Access
-
- DHCP Overview
- Firewall as a DHCP Server and Client
- Firewall as a DHCPv6 Client
- DHCP Messages
- Dynamic IPv6 Addressing on the Management Interface
- Configure an Interface as a DHCP Server
- Configure an Interface as a DHCPv4 Client
- Configure an Interface as a DHCPv6 Client with Prefix Delegation
- Configure the Management Interface as a DHCP Client
- Configure the Management Interface for Dynamic IPv6 Address Assignment
- Configure an Interface as a DHCP Relay Agent
-
- DNS Overview
- DNS Proxy Object
- DNS Server Profile
- Multi-Tenant DNS Deployments
- Configure a DNS Proxy Object
- Configure a DNS Server Profile
- Use Case 1: Firewall Requires DNS Resolution
- Use Case 2: ISP Tenant Uses DNS Proxy to Handle DNS Resolution for Security Policies, Reporting, and Services within its Virtual System
- Use Case 3: Firewall Acts as DNS Proxy Between Client and Server
- DNS Proxy Rule and FQDN Matching
-
- NAT Rule Capacities
- Dynamic IP and Port NAT Oversubscription
- Dataplane NAT Memory Statistics
-
- Translate Internal Client IP Addresses to Your Public IP Address (Source DIPP NAT)
- Create a Source NAT Rule with Persistent DIPP
- PAN-OS
- Strata Cloud Manager
- Enable Clients on the Internal Network to Access your Public Servers (Destination U-Turn NAT)
- Enable Bi-Directional Address Translation for Your Public-Facing Servers (Static Source NAT)
- Configure Destination NAT with DNS Rewrite
- Configure Destination NAT Using Dynamic IP Addresses
- Modify the Oversubscription Rate for DIPP NAT
- Reserve Dynamic IP NAT Addresses
- Disable NAT for a Specific Host or Interface
-
- Network Packet Broker Overview
- How Network Packet Broker Works
- Prepare to Deploy Network Packet Broker
- Configure Transparent Bridge Security Chains
- Configure Routed Layer 3 Security Chains
- Network Packet Broker HA Support
- User Interface Changes for Network Packet Broker
- Limitations of Network Packet Broker
- Troubleshoot Network Packet Broker
-
- Enable Advanced Routing
- Logical Router Overview
- Configure a Logical Router
- Create a Static Route
- Configure BGP on an Advanced Routing Engine
- Create BGP Routing Profiles
- Create Filters for the Advanced Routing Engine
- Configure OSPFv2 on an Advanced Routing Engine
- Create OSPF Routing Profiles
- Configure OSPFv3 on an Advanced Routing Engine
- Create OSPFv3 Routing Profiles
- Configure RIPv2 on an Advanced Routing Engine
- Create RIPv2 Routing Profiles
- Create BFD Profiles
- Configure IPv4 Multicast
- Configure MSDP
- Create Multicast Routing Profiles
- Create an IPv4 MRoute
-
-
PAN-OS 11.2
- PAN-OS 11.2
- PAN-OS 11.1
- PAN-OS 11.0 (EoL)
- PAN-OS 10.2
- PAN-OS 10.1
- PAN-OS 10.0 (EoL)
- PAN-OS 9.1 (EoL)
- PAN-OS 9.0 (EoL)
- PAN-OS 8.1 (EoL)
- Cloud Management and AIOps for NGFW
Advanced LSVPN Configuration with iBGP
This use case illustrates how GlobalProtect
LSVPN securely connects distributed office locations with primary
and disaster recovery data centers that house critical applications
for users and how internal border gateway protocol (iBGP) eases
deployment and upkeep. Using this method, you can extend up to 500
satellite offices connecting to a single gateway.
BGP is a
highly scalable, dynamic routing protocol that is ideal for hub-and-spoke
deployments such as LSVPN. As a dynamic routing protocol, it eliminates
much of the overhead associated with access routes (static routes)
by making it relatively easy to deploy additional satellite firewalls.
Due to its route filtering capabilities and features such as multiple
tunable timers, route dampening, and route refresh, BGP scales to
a much higher number of routing prefixes with greater stability
than other routing protocols like RIP and OSPF. In the case of iBGP,
a peer group, which includes all the satellites and gateways in
the LSVPN deployment, establishes adjacencies over the tunnel endpoints.
The protocol then implicitly takes control of route advertisements,
updates, and convergence.
In this example configuration, an
active/passive HA pair of PA-5200 firewalls is deployed in the primary
(active) data center and acts as the portal and primary gateway.
The disaster recovery data center also has two PA-5200s in an active/passive
HA pair acting as the backup LSVPN gateway. The portal and gateways
serve 500 PA-220s deployed as LSVPN satellites in branch offices.
Both
data center sites advertise routes but with different metrics. As
a result, the satellites prefer and install the active data center’s
routes. However, the backup routes also exist in the local routing
information base (RIB). If the active data center fails, the routes
advertised by that data center are removed and replaced with routes
from the disaster recovery data center’s routes. The failover time
depends on selection of iBGP times and routing convergence associated
with iBGP.

The
following workflow shows the steps for configuring this deployment:
- Create Interfaces and Zones for the LSVPN.Portal and Primary gateway:
- Zone: LSVPN-Untrust-Primary
- Interface: ethernet1/21
- IPv4: 172.16.22.1/24
- Zone: L3-Trust
- Interface: ethernet1/23
- IPv4: 200.99.0.1/16
Backup gateway:- Zone: LSVPN-Untrust-Primary
- Interface: ethernet1/5
- IPv4: 172.16.22.25/24
- Zone: L3-Trust
- Interface: ethernet1/6
- IPv4: 200.99.0.1/16
Satellite:- Zone: LSVPN-Sat-Untrust
- Interface: ethernet1/1
- IPv4: 172.16.13.1/22
- Zone: L3-Trust
- Interface: ethernet1/2.1
- IPv4: 200.101.1.1/24
Configure the zones, interfaces, and IP addresses on each satellite. The interface and local IP address will be different for each satellite. This interface is used for the VPN connection to the portal and gateway. - On the firewall(s) hosting GlobalProtect gateway(s), configure the logical tunnel interface that will terminate VPN tunnels established by the GlobalProtect satellites.Primary gateway:
- Interface: tunnel.5
- IPv4: 10.11.15.254/22
- Zone: LSVPN-Tunnel-Primary
Backup gateway:- Interface: tunnel.1
- IPv4: 10.11.15.245/22
- Zone: LSVPN-Tunnel-Backup
- Enable SSL Between GlobalProtect LSVPN Components.The gateway uses the self-signed root certificate authority (CA) to issue certificates for the satellites in a GlobalProtect LSVPN. Because one firewall houses the portal and primary gateway, a single certificate is used for authenticating to the satellites. The same CA is used to generate a certificate for the backup gateway. The CA generates certificates that pushed to the satellites from the portal and then used by the satellites to authenticate to the gateways.You must also generate a certificate from the same CA for the backup gateway, allowing it to authenticate with the satellites.
- On the firewall hosting the GlobalProtect portal, create the root CA certificate for signing the certificates of the GlobalProtect components. In this example, the root CA certificate is called CA-cert.
- Create SSL/TLS service profiles for the GlobalProtect portal and gateways. Because the GlobalProtect portal and primary gateway are the same firewall interface, you can use the same server certificate for both components.
- Root CA Certificate: CA-Cert
- Certificate Name: LSVPN-Scale
- Repeat steps 2 through 5 on the backup gateway with the following settings:
- Root CA Certificate: CA-cert
- Certificate Name: LSVPN-back-GW-cert
- Configure GlobalProtect Gateways for LSVPN.
- Select NetworkGlobalProtectGateways and click Add.
- On the General tab, name the primary gateway LSVPN-Scale.
- Under Network Settings, select ethernet1/21 as the primary gateway interface and enter 172.16.22.1/24 as the IP address.
- On the Authentication tab, select the LSVPN-Scale certificate created in3.
- Select SatelliteTunnel Settings and select Tunnel Configuration. Set the Tunnel Interface to tunnel.5. All satellites in this use case connect to a single gateway, so a single satellite configuration is needed. Satellites are matched based on their serial numbers, so no satellites will need to authenticate as a user.
- On SatelliteNetwork Settings, define the pool of IP address to assign to the tunnel interface on the satellite once the VPN connection is established. Because this use case uses dynamic routing, the Access Routes setting remains blank.
- Repeat steps 1 through 5 on the backup gateway with the following settings:
- Name: LSVPN-backup
- Gateway interface: ethernet1/5
- Gateway IP: 172.16.22.25/24
- Server cert: LSVPN-backup-GW-cert
- Tunnel interface: tunnel.1
- Configure iBGP on the primary and backup gateways and add a redistribution profile to allow the satellites to inject local routes back to the gateways.Each satellite office manages its own network and firewall, so the redistribution profile called ToAllSat is configured to redistribute local routes back to the GlobalProtect gateway.
- Select NetworkVirtual Routers and Add a virtual router.
- On Router Settings, add the Name and Interface for the virtual router.
- On Redistribution Profile and select Add.
- Name the redistribution profile ToAllSat and set the Priority to 1.
- Set Redistribute to Redist.
- Add ethernet1/23 from the Interface drop-down.
- Click OK.
- Select BGP on the Virtual Router to configure BGP.
- On BGPGeneral, select Enable.
- Enter the gateway IP address as the Router ID (172.16.22.1) and 1000 as the AS Number.
- In the Options section, select Install Route.
- On BGPPeer Group, click Add a peer group with all the satellites that will connect to the gateway.
- On BGPRedist Rules, Add the ToAllSat redistribution profile you created previously.
- Click OK.
- Repeat steps 1 through 5 on the backup gateway using ethernet1/6 for the redistribution profile.
- Prepare the Satellite to Join the LSVPN.The configuration shown is a sample of a single satellite.Repeat this configuration each time you add a new satellite to the LSVPN deployment.
- Configure a tunnel interface as the tunnel endpoint for the VPN connection to the gateways.
- Set the IPSec tunnel type to GlobalProtect Satellite and enter the IP address of the GlobalProtect Portal.
- Select NetworkVirtual Routers and Add a virtual router.
- On Router Settings, add the Name and Interface for the virtual router.
- Select Virtual RouterRedistribution Profile and Add a profile with the following settings.
- Name the redistribution profile ToLSVPNGW and set the Priority to 1.
- Add an Interface ethernet1/2.1.
- Click OK.
- Select BGPGeneral, Enable BGP and configure the protocol as follows:
- Enter the gateway IP address as the Router ID (172.16.22.1) and 1000 as the AS Number.
- In the Options section, select Install Route.
- On BGPPeer Group, Add a peer group containing all the satellites that will connect to the gateway.
- On BGPRedist Rules, Add the ToLSVPNGW redistribution profile you created previously.
- Click OK.
- Configure the GlobalProtect Portal for LSVPN.Both data centers advertise their routes but with different routing priorities to ensure that the active data center is the preferred gateway.
- Select NetworkGlobalProtectPortals and click Add.
- On General, enter LSVPN-Portal as the portal name.
- On Network Settings, select ethernet1/21 as the Interface and select 172.16.22.1/24 as the IP Address.
- On the Authentication tab, select the previously created primary gateway SSL/TLS Profile LSVPN-Scale from the SSL/TLS Service Profile drop-down menu.
- On the Satellite tab, Add a satellite and Name it sat-config-1.
- Set the Configuration Refresh Interval to 12.
- On GlobalProtect SatelliteDevices, add the serial number and hostname of each satellite device in the LSVPN.
- On GlobalProtect SatelliteGateways, add the name and IP address of each gateway. Set the routing priority of the primary gateway to 1 and the backup gateway to 10 to ensure that the active data center is the preferred gateway.
- (Optional) Add a new site to the LSVPN deployment.
- Select NetworkGlobalProtectPortalsGlobalProtect PortalSatellite ConfigurationGlobalProtect SatelliteDevices to add the serial number of the new satellite to the GlobalProtect portal.
- Configure the IPSec tunnel on the satellite with the GlobalProtect Portal IP address.
- Select NetworkVirtual RouterBGPPeer Group to add the satellite to the BGP Peer Group configuration on each gateway.
- Select NetworkVirtual RouterBGPPeer Group to add the gateways to the BGP Peer Group configuration on the new satellite.