Configure the NGFW IPSec Tunnel

1. Confirm interface and zone assignments.

   1. In the NGFW web interface, select NetworkInterfacesEthernet and confirm the following assignments.

      Interface	Type	Zone
      Untrust interface (internet-facing)	Layer3	untrust
      Trust interface (branch-facing)	Layer3	trust

      If you have not already created untrust and trust zones, select NetworkZones and create them with type Layer3.
2. Create an IKE crypto profile.

   1. Select NetworkNetwork ProfilesIKE Crypto and click Add.
   2. Configure the IKE crypto profile settings.

      Field	Value
      Name	A descriptive name (for example, pa-ike-crypto)
      DH Group	Group 14
      Encryption	AES-256-CBC
      Authentication	SHA-256
      Key Lifetime	8 hours

      Use an explicit crypto profile. Do not select default — the default profile can cause IKE negotiation failures with Prisma Access.
   3. Click OK.
3. Create an IPSec crypto profile.

   1. Select NetworkNetwork ProfilesIPSec Crypto and click Add.
   2. Configure the IPSec crypto profile settings.

      Field	Value
      Name	A descriptive name (for example, pa-ipsec-crypto)
      Encryption	AES-256-CBC
      Authentication	SHA-256
      DH Group	Group 14

   3. Click OK.
4. Create an IKE gateway.

   1. Select NetworkNetwork ProfilesIKE Gateways and click Add.
   2. On the General tab, configure the following settings.

      Field	Value
      Name	A descriptive name (for example, pa-ike-gw)
      Version	IKEv2 only mode
      Interface	The NGFW untrust interface
      Peer IP Address	The Prisma Access Service Endpoint IP from the bandwidth allocation step
      Authentication	Pre-Shared Key
      Pre-Shared Key	The same PSK you configured in Strata Cloud Manager
      Local Identification	IP Address — enter the NGFW's external (public) untrust IP

      Set the Local Identification field to the NGFW's external public IP. If your NGFW is behind NAT, PAN-OS sends the internal interface IP as the IKE identity by default, and Prisma Access rejects this with an authentication failure.
   3. On the Advanced Options tab, configure the following settings.

      Field	Value
      NAT Traversal	Enabled
      IKE Crypto Profile	Select the profile you created in step 2

   4. Click OK.
5. Create a tunnel interface.

   1. Select NetworkInterfacesTunnel and click Add.
   2. Configure the tunnel interface settings.

      Field	Value
      Interface Name	tunnel.1
      Logical Router	default
      Security Zone	untrust

   3. Click OK.
6. Create the IPSec tunnel.

   1. Select NetworkIPSec Tunnels and click Add.
   2. Configure the IPSec tunnel settings.

      Field	Value
      Name	A descriptive name (for example, pa-rbi-tunnel)
      Tunnel Interface	tunnel.1
      Type	Auto Key
      Address Type	IPv4
      IKE Gateway	Select the gateway you created in the step 4
      IPSec Crypto Profile	Select the profile you created in the step 3

   3. Click OK.
7. Add a default route through the tunnel.

   1. Select NetworkRoutingLogical RoutersdefaultStatic RoutesIPv4 and click Add.
   2. Configure the static route settings.

      Field	Value
      Name	A descriptive name (for example, default-via-tunnel)
      Destination	0.0.0.0/0
      Interface	tunnel.1
      Next Hop	None

      Do not configure source NAT (SNAT) for tunnel traffic. Prisma Access handles all egress NAT for outbound traffic. Adding SNAT causes Prisma Access to receive the NGFW interface IP as the source instead of the original endpoint IP.
   3. Click OK.
8. Create a security policy to allow traffic from the trust zone to the internet.

   1. Select PoliciesSecurity and click Add.
   2. Configure the security policy settings.

      Field	Value
      Name	A descriptive name (for example, trust-to-internet)
      Source Zone	trust
      Destination Zone	untrust
      Application	any
      Service	application-default
      Action Settings	Allow

   3. Click OK.
9. Select Commit.

   After the commit completes, select NetworkIPSec Tunnels — the tunnel status should show green within a few minutes. If the tunnel does not come up, check MonitorLogsSystem for IKE negotiation errors.