Skip to main content

VPN Site-to-Site configuration with Palo Alto

Prerequisites​

Ensure the following conditions are met before starting:

  • The VPN Site-to-Site service is set up on FPT Cloud Portal.
  • A Palo Alto firewall is installed and enabled on the customer side.
  • The Palo Alto firewall has three IP addresses configured: Management (Public IP), WAN (Public IP), and LAN.

Step 1: Configure VPN Site-to-Site on FPT Cloud Portal​

Create a Customer Gateway and a VPN Connection for the Palo Alto device on the FPT Cloud Portal. For detailed steps, see Create VPN connection.

Step 2: Configure IPsec on Palo Alto​

  1. Log in to Palo Alto via the Management IP.

Login

  1. Click Add and activate the Palo Alto Zone.

Zone

  1. Create a Virtual Router and click OK.

Virtual Router

  1. Create WAN and LAN interfaces (for example, ethernet1/1 and ethernet1/2).

WAN interface

LAN interface

Interface config

Interface result

  1. Create an IKE Crypto profile.

IKE Crypto

  1. Create an IPSec Crypto profile.

IPSec Crypto

  1. Go to IPsec Tunnels:

    • In the General tab, enter the Peer Address as the FPT Cloud IP from Step 1 (e.g., 103.176.147.48).
    • In the Authentication section, enter the Pre-shared key value from the VPN Connection created in Step 1.

General tab

  • In the Advanced Options tab, fill in the required details.

Advanced Options

  • Create a GlobalProtect IPSec entry.

GlobalProtect IPSec

  1. Create the IPSec Tunnels.

IPSec Tunnel 1

IPSec Tunnel 2

IPSec Tunnel 3

Step 3: Configure firewall and routing on Palo Alto​

  1. Open a firewall policy.

Firewall policy

Policy config

Policy result

Configure the source and destination according to your environment rules.

  1. Configure routing between the two subnets (e.g., 30.30.30.0/24 and 80.80.80.0/24). Adjust to match your actual source and destination networks.

Routing config

You can now open a terminal to test network connectivity using ping.

See also​