Create Interfaces and Zones for the LSVPN
You must configure the following interfaces and zones for your LSVPN infrastructure:
- GlobalProtect portal—Requires a Layer 3 interface for GlobalProtect satellites to connect to. If the portal and gateway are on the same firewall, they can use the same interface. The portal must be in a zone that is accessible from your branch offices.
- GlobalProtect gateways—Requires three interfaces: a Layer 3 interface in the zone that is reachable by the remote satellites, an internal interface in the trust zone that connects to the protected resources, and a logical tunnel interface for terminating the VPN tunnels from the satellites. Unlike other site-to-site VPN solutions, the GlobalProtect gateway only requires a single tunnel interface, which it will use for tunnel connections with all of your remote satellites (point-to-multi-point). If you plan to use dynamic routing, you must assign an IP address to the tunnel interface. GlobalProtect supports both IPv6 and IPv4 addressing for the tunnel interface.
- GlobalProtect satellites—Requires a single tunnel interface for establishing a VPN with the remote gateways (up to a maximum of 25 gateways). If you plan to use dynamic routing, you must assign an IP address to the tunnel interface. GlobalProtect supports both IPv6 and IPv4 addressing for the tunnel interface.
For more information about portals, gateways, and satellites see LSVPN Overview.
- Configure a Layer 3 interface.The portal and each gateway and satellite all require a Layer 3 interface to enable traffic to be routed between sites.If the gateway and portal are on the same firewall, you can use a single interface for both components.
- Selectand then select the interface you want to configure for GlobalProtect LSVPN.NetworkInterfacesEthernet
- SelectLayer3from theInterface Typedrop-down.
- On theConfigtab, select theSecurity Zoneto which the interface belongs:
- The interface must be accessible from a zone outside of your trust network. Consider creating a dedicated VPN zone for visibility and control over your VPN traffic.
- If you have not yet created the zone, selectNew Zonefrom theSecurity Zonedrop-down, define aNamefor the new zone and then clickOK.
- Select theVirtual Routerto use.
- Assign an IP address to the interface:
- For an IPv4 address, selectIPv4andAddthe IP address and network mask to assign to the interface, for example 18.104.22.168/24.
- For an IPv6 address, selectIPv6,Enable IPv6 on the interface, andAddthe IP address and network mask to assign to the interface, for example 2001:1890:12f2:11::10.1.8.160/80.
- To save the interface configuration, clickOK.
- On the firewall(s) hosting GlobalProtect gateway(s), configure the logical tunnel interface that will terminate VPN tunnels established by the GlobalProtect satellites.IP addresses are not required on the tunnel interface unless you plan to use dynamic routing. However, assigning an IP address to the tunnel interface can be useful for troubleshooting connectivity issues.Make sure to enable User-ID in the zone where the VPN tunnels terminate.
- Selectand clickNetworkInterfacesTunnelAdd.
- In theInterface Namefield, specify a numeric suffix, such as.2.
- On theConfigtab, expand theSecurity Zonedrop-down to define the zone as follows:
- To use your trust zone as the termination point for the tunnel, select the zone from the drop-down.
- (Recommended) To create a separate zone for VPN tunnel termination, clickNew Zone. In the Zone dialog, define aNamefor new zone (for examplelsvpn-tun), select theEnable User Identificationcheck box, and then clickOK.
- Select theVirtual Router.
- (Optional) To assign an IP address to the tunnel interface:
- IPv4andAddthe IP address and network mask to assign to the interface, for example 22.214.171.124/24.
- IPv6,Enable IPv6 on the interface, andAddthe IP address and network mask to assign to the interface, for example 2001:1890:12f2:11::10.1.8.160/80.
- To save the interface configuration, clickOK.
- If you created a separate zone for tunnel termination of VPN connections, create a security policy to enable traffic flow between the VPN zone and your trust zone.For example, a policy rule enables traffic between thelsvpn-tunzone and theL3-Trustzone.
- Commit your changes.ClickCommit.
Prepare the Satellite to Join the LSVPN
Prepare the Satellite to Join the LSVPN To participate in the LSVPN, the satellites require a minimal amount of configuration. Because the required configuration is ...
Create Interfaces and Zones for GlobalProtect
Create Interfaces and Zones for GlobalProtect You must configure the following interfaces and zones for your GlobalProtect infrastructure: GlobalProtect portal —Requires a Layer 3 or ...
Configure GlobalProtect Gateways for LSVPN
Configure GlobalProtect Gateways for LSVPN Because the GlobalProtect configuration that the portal delivers to the satellites includes the list of gateways the satellite can connect ...
Basic LSVPN Configuration with Static Routing
Basic LSVPN Configuration with Static Routing This quick config shows the fastest way to get up and running with LSVPN. In this example, a single ...
Advanced LSVPN Configuration with iBGP
Advanced LSVPN Configuration with iBGP This use case illustrates how GlobalProtect LSVPN securely connects distributed office locations with primary and disaster recovery data centers that ...
GlobalProtect Gateway Satellite Configuration Tab
GlobalProtect Gateway Satellite Configuration Tab A satellite is a Palo Alto Networks firewall—typically at a branch office—that acts as a GlobalProtect agent to enable it ...
Advanced LSVPN Configuration with Dynamic Routing
Advanced LSVPN Configuration with Dynamic Routing In larger LSVPN deployments with multiple gateways and many satellites, investing a little more time in the initial configuration ...
Site-to-Site VPN with Static and Dynamic Routing
Site-to-Site VPN with Static and Dynamic Routing In this example, one site uses static routes and the other site uses OSPF. When the routing protocol ...
Site-to-Site VPN with Static Routing
Site-to-Site VPN with Static Routing The following example shows a VPN connection between two sites that use static routes. Without dynamic routing, the tunnel interfaces ...