! Using IPsec on CloudEOS and vEOS and Third Party Devices Running Configuration for CloudEOS and vEOS1 ip security The instances are the tunnel endpoints of a VTI IPsec tunnel. The following examples show the running configurations for two CloudEOS and vEOS Router instances (CloudEOS and vEOS1 and CloudEOS and vEOS2). ! Examples of Running-configurations for VTI IPsec Tunnels ! Running Configuration for CloudEOS and vEOS2 ip security The instances are the tunnel endpoints of a GRE-over-IPsec tunnel. Then, apply the IPsec profile configuration to the tunnel interface. To enable the feature, include the flow parallelization encapsulation udp command in the IPsec profile configuration.

Enable the IPsec flow parallelization feature to achieve high throughput over the IPsec tunnel.

Switch(config-if-Tu1)#tunnel ipsec profile vrouter Switch(config-if-Tu1)#tunnel destination 1.0.0.2 Switch(config-if-Tu1)#tunnel source 1.0.0.1 Switch(config-if-Tu1)#vrf forwarding blue Switch(config-vrf-blue)#interface tunnel1

Switch(config-if-Tu0)#tunnel ipsec profile vrouter Switch(config-if-Tu0)#tunnel destination 1.0.0.2 Switch(config-if-Tu0)#tunnel source 1.0.0.1 The transport option under the IPsec mode has no effect.

When using VTI encapsulation mode, set the IPsec mode to tunnel.

This ensures that the packets forwarded on the interface are encrypted.

Select this encapsulation type by specifying tunnel mode ipsec for the tunnel interface to which the IPsec profile is applied.

In VTI encapsulation mode, the application payload is directly encapsulated and encrypted by the IPsec header.

When using GRE-over-IPsec encapsulation mode, both IPsec mode options are supported (select either transport or tunnel).

Select this encapsulation type by specifying tunnel mode gre for the tunnel interface to which the IPsec profile is applied.

IPsec then encrypts the GRE packet, which results in the packet being encapsulated and encrypted by the IPsec header.

In GRE-over-IPsec encapsulation mode, the application payload is first encapsulated within a GRE packet.

The tunnel types are determined based on the encapsulation mode.

Newly generated log is sent to the Syslog server.The CloudEOS and vEOS Router supports the use of two basic types of IPsec tunnels.

After IPSec tunnel is brought up tunnel interface also goes up and a new message 'tunnel is UP' is generated in system logs.

Syslog server receives 'tunnel down' message.

Time Severity Subtype Object EventID ID DescriptionДў015/11 /15 13:24:34 low vpn tunnel- 0 Tunnel is down

When tunnel monitor fails firewall generates the following message in the system log:.

Configure Device > Log Setting > System to send logs to Syslog server.

Configure Tunnel Monitor feature on the firewall.

At this point in time PA devices do not support VPN tunnel monitoring events through SNMP MIB's.ДЄs a workaroundВ we can rely on Syslog server and the logs we send to it. A tunnel monitor was set up to monitor IPsec VPN Tunnels on the between PA device and want to generate an alert if the tunnel goes down.

Palo alto networks vpn tunnel monitor