Network Security
Proxy ID for IPSec VPN
Table of Contents
Expand All
|
Collapse All
Network Security Docs
-
- Security Policy
-
- Security Profile Groups
- Security Profile: AI Security
- Security Profile: WildFire® Analysis
- Security Profile: Antivirus
- Security Profile: Vulnerability Protection
- Security Profile: Anti-Spyware
- Security Profile: DNS Security
- Security Profile: DoS Protection Profile
- Security Profile: File Blocking
- Security Profile: URL Filtering
- Security Profile: Data Filtering
- Security Profile: Zone Protection
-
- Policy Object: Address Groups
- Policy Object: Regions
- Policy Object: Traffic Objects
- Policy Object: Applications
- Policy Object: Application Groups
- Policy Object: Application Filter
- Policy Object: Services
- Policy Object: Auto-Tag Actions
- Policy Object: Devices
-
- Uses for External Dynamic Lists in Policy
- Formatting Guidelines for an External Dynamic List
- Built-in External Dynamic Lists
- Configure Your Environment to Access an External Dynamic List
- Configure your Environment to Access an External Dynamic List from the EDL Hosting Service
- Retrieve an External Dynamic List from the Web Server
- View External Dynamic List Entries
- Enforce Policy on an External Dynamic List
- Find External Dynamic Lists That Failed Authentication
- Disable Authentication for an External Dynamic List
- Policy Object: HIP Objects
- Policy Object: Schedules
- Policy Object: Quarantine Device Lists
- Policy Object: Dynamic User Groups
- Policy Object: Custom Objects
- Policy Object: Log Forwarding
- Policy Object: Authentication
- Policy Object: Decryption Profile
- Policy Object: Packet Broker Profile
-
-
-
- The Quantum Computing Threat
- How RFC 8784 Resists Quantum Computing Threats
- How RFC 9242 and RFC 9370 Resist Quantum Computing Threats
- Support for Post-Quantum Features
- Post-Quantum Migration Planning and Preparation
- Best Practices for Resisting Post-Quantum Attacks
- Learn More About Post-Quantum Security
-
-
-
- Investigate Reasons for Decryption Failure
- Identify Weak Protocols and Cipher Suites
- Troubleshoot Version Errors
- Troubleshoot Unsupported Cipher Suites
- Identify Untrusted CA Certificates
- Repair Incomplete Certificate Chains
- Troubleshoot Pinned Certificates
- Troubleshoot Expired Certificates
- Troubleshoot Revoked Certificates
Proxy ID for IPSec VPN
Learn about proxy ID and how to set up the proxy ID to implement the Palo Alto
Networks IPSec.
Where Can I Use This? | What Do I Need? |
---|---|
| No license required |
Proxy Identity or proxy ID refers to a set of traffic that belongs to an IPSec VPN which
is subjected to the SA being negotiated between peers (or setup once the negotiation has
succeeded).
It allows identifying and then directing the traffic:
- to appropriate tunnel where multiple tunnels coexist between the same two peers that share the same IKE gateway.
- allows unique and shared SAs with different parameters to coexist.
Use proxy IDs in the configurations where VPN tunnels are set up between the same two
peers.
Proxy IDs help identify what traffic belongs to a particular IPSec VPN. This lets an
operating system install the appropriate hooks to direct traffic that matches the source
and destination address in the proxy ID (client ID) and direct it into the matching
IPSec SA or VPN into and out of the matching IPSec SAs.
Setting up the Proxy ID
Palo Alto Networks is among a few other vendors that use proxy IDs. The following
figure shows the Palo Alto Networks proxy ID window along with its options.

Select NetworkIPSec TunnelProxy IDs. Enter the proxy ID name, local IP address, remote IP address if
required by the peer, and the protocol type along with its local and remote port
numbers.
Each proxy ID is considered to be a VPN tunnel and therefore
is counted towards the IPSec VPN tunnel capacity of the firewall. For example, the
maximum limit for a site-to-site IPSec VPN tunnel is 1000 for PA-3020, 100 for
PA-2050, and 25 for PA-200.
Proxy IDs behave differently with IKE versions:
- IKEv1—Palo Alto Networks devices support only proxy ID exact matches. If proxy IDs for peers do not match, then the VPN does not work correctly.
- IKEv2—Supports traffic selector narrowing when proxy ID setting is different on the two VPN gateways.
Using Proxy IDs
The following example shows two VPN gateways: A and B.
IKE negotiation is started by VPN GW-az, i=initiator, r=responder. VPN GW-a defines
traffic selector TSi-a/TSr-a and VPN GW-b specifies traffic selector TSi-b/TSr-b.
While TSr-a is the same as TSr-b and so it can be ignored, TSi-a can be different
from TSi-b.
In this case, the traffic cannot route over the VPN tunnel since the same network
exists on both sides of the tunnel.
However, as shown below, the only way to resolve this issue is for both peer gateways
to create NATs to translate a new, unique network
subnet to the internal network otherwise one side has to change the subnet IP.

This way, all traffic on either side would be destined to the new NAT address instead
of the other similar network. Both gateways would have to perform NAT for this to work properly to
remove any confusions about which network is on which side.
Configuring IPSec VPN for a Palo Alto Networks Firewall
If the other side of the tunnel is a third-party VPN device otherwise a non PAN-OS
firewall, then you need to specify a matching local proxy ID and remote proxy ID:
typically the local and remote LAN subnets.
When configuring an IPSec tunnel proxy ID to identify local and remote IP networks
for traffic that is NATed, the proxy ID configuration for the IPSec tunnel must be
configured with the post-NAT IP network information. The reason for this is that the
proxy ID information defines the networks that will be allowed through the tunnel on
both sides for the IPSec configuration.