Configure Prisma Access for Mobile Users in China

In the Panorama that manages Prisma Access, select

Network

Network Profiles

IKE Crypto

Add

and

Add

an IKE crypto profile for the IPSec tunnel.

Select the template you want to use for the connection. If you are creating a service connection, select

Service_Conn_Template

; if you are creating a remote network connection, select

Remote_Network_Template

.

Give the profile a name and specify IKE settings.

Make a note of these settings; you specify the same settings when you create the IPSec tunnel in the router instance you configure in Alibaba Cloud.



Select

Network

Network Profiles

IPSec Crypto

and create a new IPSec crypto profile in Panorama, making a note of the settings you specify.

Skip this step if you have already created an IPSec crypto profile.



Select

Network

Network Profiles

IKE Gateways

and

Add

a new IKE gateway, specifying the following parameters:

Specify a
Version
of
IKEv2 only mode
.
Specify a
Peer IP Address Type
of
Dynamic
.
Enter a
Pre-Shared Key
.
Specify
User FQDN (email address)
for
Local Identification
and
Peer Identification
and enter the IP addresses to use.



Select

Advanced Options

and enable

NAT Traversal

.



Select

Network

IPSec Tunnels

and

Add

an IPSec tunnel, specifying the

IPSec Crypto Profile

you just created.



Onboard a new service connection or remote network connection, specifying the following parameters:

Select a location that is close to the location of VPC 2.
Enter placeholder
Corporate Subnets
(for service connections) or
Branch IP Subnets
(for remote network connections). You add valid subnets when you deploy the VM-series firewall in Alibaba cloud after you create Linux instances in the Alibaba Cloud VPCs.
This example uses static routes; you can also configure BGP routing for your deployment.



Commit your changes to Panorama (

Commit

Commit to Panorama

), then commit and push your changes (

Commit

Commit and Push

).

Select

Panorama

Cloud Services

Status

Network Details

and note the

Service IP Address

for the service connections you onboarded.