Configure Data Center (DC-DC) Interconnectivity

1. Select ConfigurationPrisma SD-WANION DevicesClaimed, select the device you want to configure and then select a port on the device to configure for HA.
2. From the ellipsis menu, select Configure the device.
3. On the Configure Interface: New Standard VPN screen, set up the Main Configuration for the new interface.

   1. For Admin Up, select Yes.
   2. (Optional) Enter a Name, Description, and Tags.
   3. Select IPsec as the Standard VPN Type.

      The Interface Type must display as Standard VPN.
   4. Select a Parent Interface to establish the GRE tunnel.

      For a data center ION device, any of the following ports can be used as a parent interface:

      • Any Connect to Internet port
      • Any Connect to Peer Network port
   5. Toggle Scope to Local or Global.
   6. Enter an Inner Tunnel IP Address or Mask.
   7. For the Endpoint name, add the name of the connected Data Center site.

      Note that although configured, the Endpoint will not be pushed to the DC ION device, since the Endpoint applies only for a branch ION device. Hence, you have to enter a Peer IP for the tunnel to be established.
   8. Enter a Peer IP of the connected DC site.

      The Peer IP is mandatory for a DC-DC tunnel.
   9. Select an IPsec Profile.

      Select a created IPsec profile.
   10. Under Advanced Options, navigate to Passive Mode.

       By default, Passive Mode is No, which means that the device can act as a responder and an initiator.

       (Optional) Select Yes for Passive Modeto have the ION device in the responder-only mode. Set one end of the tunnel to Yes and the other end to No.

4. Click Create Standard VPN.

   You can view the DC-DC tunnels on the Overlays Connection page for a DC site.

   Port Translation between Data Centers

   If one of the ION devices is behind a NAT device, you need to configure an inbound DNAT rule for port translation for the receiving ION device, so that port 4500 is translated to port 4501 for a given IP address.