{"id":3459,"date":"2022-04-28T22:15:16","date_gmt":"2022-04-29T06:15:16","guid":{"rendered":"https:\/\/tungle.ca\/?p=3459"},"modified":"2022-04-28T22:15:45","modified_gmt":"2022-04-29T06:15:45","slug":"deploy-an-ipsec-vpn-site-to-site-between-palo-alto-on-prem-and-virtual-private-gateway-on-gcp","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=3459","title":{"rendered":"Deploy an IPSEC VPN site-to-site between Palo Alto on-prem and Virtual Private Gateway on GCP"},"content":{"rendered":"\n

This is a diagram that I have used for the lab.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Create a new VPC network on GCP.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Search VPN keyword on the search function.<\/p>\n\n\n\n

Click “Create VPN connection”.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Select Classic VPN.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Select tung-vpc on the network setting.<\/p>\n\n\n\n

Create a new static IP address for your VPC.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Delete tunnel 2 because I have only used tunnel 1 in this lab. Then click Create.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Click gpc-pa-tunnel-1.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Edit the Routes to allow traffic from my tung-vpc network to the Internet via the Default Internet gateway.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

We can see the static route from privatesubnet on GCP to the LAN subnets on Palo Alto has been created on the Routes section.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Check the Firewall and allow SSH from the Internet to Linux instance on the “privatesubnet”.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

I have used “Allow all” to allow SSH from the Internet to Linux instance, We are able to change to only allow SSH protocol or port 22. Click Create.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Search “compute engine”, and click create an instance.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

On network interfaces.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Click create.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Open SSH in browser windows on the Linux instance.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Back to Palo Alto.<\/p>\n\n\n\n

IKECrypto.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

IPSECCrypto.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

IPSECTunnel.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Create both network objects for the Palo Alto-LAN subnet and GCP-LAN subnet <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Create both access rules to allow traffic from Palo Alto LAN subnets to GCP privatesubnet.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

This is the network interface on PA.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Create a new static route to allow traffic from PA LAN subnets to GCP privatesubnet.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Then, click commit.<\/p>\n\n\n\n

Back to GCP.<\/p>\n\n\n\n

Ping Kali machine on PA LAN subnet from the Linux instance on GCP.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On Kali machine, ping Linux instance on GCP.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The Palo Alto VPN site-to-site tunnel with GCP is up.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The IPSEC VPN site-to-site tunnel is up on GCP as well.<\/p>\n\n\n\n

\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"

This is a diagram that I have used for the lab. Create a new VPC network on GCP. Search VPN keyword on the search function. Click “Create VPN connection”. Select Classic VPN. Select tung-vpc on the network setting. Create a new static IP address for your VPC. Delete tunnel 2 because I have only used […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,21],"tags":[20,18],"class_list":["post-3459","post","type-post","status-publish","format-standard","hentry","category-cloud","category-palo-alto","tag-cloud","tag-palo-alto"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/3459","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3459"}],"version-history":[{"count":1,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/3459\/revisions"}],"predecessor-version":[{"id":3512,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/3459\/revisions\/3512"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3459"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3459"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3459"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}