IPsec Site to Site VPN between Palo Alto On-premises and AWS over BGP

Configure IPsec VPN over BGP between Palo Alto and AWS.
Testing with Palo Alto on eve-ng and ubuntu server instance in AWS

[@reginrnair9176]

great work, well explained . Thank you

[@techfrapi]

Glad you liked it

[@AlanMartinez-do9jh]

Can you do any example between Azure & Palo Alto, with 2 VPN's IPSec Active/Active with Gateway BGP? Please

[@stevengutierrez605]

This was great men thank you

[@techfrapi]

You're very welcome

[@ihsanfavy9265]

why we need additional rule like ike and ipsec, because while we configure the normal site2site , those rule doesn't need it

[@techfrapi]

Which additional rules exactly

[@atiyousefiattaei4103]

Thank you very much!

[@techfrapi]

You're welcome!

[@fabriciotorres]

Thank you so much!

[@techfrapi]

You're welcome!

[@Bormanb23]

Awesome video

[@techfrapi]

Glad you enjoyed it

[@jerseyjeeper1575]

Excellent thanks!

[@techfrapi]

Thanks

[@Bormanb23]

Would you know how to give one tunnel priority over the other? (active/standby) in Palo? I see you configured the tunnel monitor

[@techfrapi]

AWS does asymmetric routing and is the recommended way of doing it, but you should be able to achieve it over the BGP to preferer one tunnel over the other

[@rouellmamaril2436]

how did you connect that aws-lan to eve-ng?

[@techfrapi]

It's not directly connected to EVE-ng, I did it this way to represent my topology. If you want to use it with eve-ng you need to do port forwarding on you router on port 500 and 4500 coming from the aws IPs

[@vishnuk9523]

@@techfrapi I'm using same setup to build ipsec tunnel to aws from fortigate firewall using eve-ng lab but tunnel not coming up. I'm using private ip as wan1 in fortigate to form ipsec with aws. How to achive can you help me ?