Hi all,
We have multiple spoke networks connected over IPSec VPN (numbered VTI, Route based VPN), with BGP.
These have been configured with an empty encryption domain and work seamlessly for all traffic types with wire mode or without.. except for IPSec over the top of our VPN tunnels which doesn’t work in either wire or firewall configuration. With wire mode off, the logs show it’s hitting our allow rule, but the log is saying “Drop” and “Failed to enforce VPN policy (11)”
A customer has a hard requirement to form IPSec encryption from their host, from within their network, to a host in another network we also VPN with. MTUs are set correctly and this worked previously inside tunnels from Palo Alto firewalls natively, without any issues or extra configuration
It seems likely the empty encryption domain is causing some fuss
Is there guidance available around why IPSec within our VPN is any different to say, TLS within our VPN, and more importantly, is it possible to allow this type of traffic to flow over our firewalls, without losing key requirements we have (BGP route based vpn)
Kind Regards,
Ian
