A Palo Alto site-to-site VPN connects networks through an encrypted tunnel. This walkthrough separates the Azure and AWS examples so teams can follow the relevant path. Treat the addresses and settings as examples and validate them against the deployed firewall and cloud gateway versions.
Palo Alto Site-to-Site VPN Guide for Azure and AWS
Last Updated • 5 Nov 2026
C
AuthorChloe Gallagher
Before you configure the VPN
Palo Alto to Azure site-to-site VPN
Configure Azure networking
- 01Create virtual network according to Microsoft article guideline.
- 02Create Front End and Gateway subnets.
- 03Create Virtual Network Gateway.
- 04Create a local network gateway according to Azure configuration guidelines.
- 05The next step is to create an IPSec policy including parameters and also a local network gateway connection that is to represent your IPSec connection from your Azure network to your on-premise network and Palo Alto firewall.
- 06Install and configure Azure PowerShell modules on my local desktop device.
- 07Launch Microsoft PowerShell and execute the following command to connect to Azure.
- 08Using the Azure Cloud Shell interface, accessible in the Azure portal you could review your IPSec parameters.
- 09Create virtual network gateway connection.
Configure the Palo Alto firewall
- Configure tunnel interface, create, and assign new security zone.
- Create an IKE Crypto profile with the following settings.
- Create a new IKE Gateway with the following settings. Peer IP equals the IP address of the Azure connection public IP address (when received after configuration). Edit configuration later, if necessary, when received.
- Configure an IKE Gateway and assign the IKE Crypto profile.
- Create a new IPSec Crypto Profile with the following settings.
- Create IPSec tunnel with the following settings.
- No proxy ID was required for this configuration example.
- Added static routes to my virtual router for both Azure Frontend and Gateway subnets.
- After completing Azure and Palo Alto configuration, there is a green status for the IPsec tunnel indicating a successful connection. Additional negotiation information may be viewed from the Palo Alto System Log.
Validate Azure connectivity
fter the Azure tunnel is established, test access between an approved local host and the intended Azure resource. Check routes, firewall rules, and logs if the connection fails.
Palo Alto to AWS site-to-site VPN
Create AWS Customer Gateway:
Sign in to the AWS console with the permissions required to configure the connection. Open the VPC service and select the intended VPC. Create a customer gateway using the firewall’s actual external address and the routing method chosen for this deployment.
- 01Name: Palo Alto Firewall.
- 02Routing: Static.
- 03IP Address: Enter Palo Alto's WAN IP as 113.161.x.x.
- 04Click Create Customer Gateway.
Create and attach the virtual private gateway
Go to VIRTUAL PRIVATE NETWORK > Virtual Private Gateways > Click Create Virtual Private Gateway.
Create a Virtual Private Gateway with the following parameters:
Create a Virtual Private Gateway with the following parameters:
- Name tag: VPG-PaloAlto Community.
- ASN: Amazon default ASN.
- Click Create Virtual Private Gateway.
Next, we will add the newly created Virtual Private Gateways to the VPC.
To Add select the newly created Virtual Private Gateways > click Action > Attach to VPC.
Select the VPC that we filtered at the Customer Gateways creation step and click Yes, Attach to complete.
Virtual Private Network has been successfully added to VPC.
Create the VPN connection
To create VIRTUAL PRIVATE NETWORK (VPN) > Site-to-Site VPN Connection > click Create VPN Connection.
Create with the following information:
Create with the following information:
- Name tag: S2S-AWS-to-PaloAlto.
- Target Gateway Type: select Virtual Private Gateway.
- Virtual Private Gateway *: select the Virtual Private Gateway just created in the above step.
- Customer Gateway: select Existing.
- Customer Gateway ID *: select the Customer Gateway just created in the previous step.
- Routing Option: Static.
- Static IP Prefixes: type Palo Alto's LAN subnet as 10.146.41.0/24.
- Local IPv4 Network Cidr: type 10.146.41.0/24.
- Remote IPv4 Network Cidr: enter AWS local network subnet as 172.31.32.0/20.
- Click Create VPN Connection.
Configure AWS routes
We need to create a static route to route the Palo Alto Firewall's subnet through the Virtual Gateway.
To create in VIRTUAL PRIVATE CLOUD > Route Tables > check existing route tables > go to Route tab > click Edit Route > click Add route.
Add:
To create in VIRTUAL PRIVATE CLOUD > Route Tables > check existing route tables > go to Route tab > click Edit Route > click Add route.
Add:
- 01Destination: 10.146.41.0/24.
- 02Target: select the newly created Virtual Gateway.
- 03Click Save changes.
Download the AWS configuration
After creating the VPN Connection, we will select the newly created VPN Connection and click Download Configuration.
Select the following information to download the configuration file:
Select the following information to download the configuration file:
- Vendor: Palo Alto Networks.
- Platform: PA Series.
- Software: PANOS 7.0+.
- Ike Version: ikev2.
Turn on the configuration file just got downloaded, we will have the following information.
IKE Crypto and IPsec Crypto of IPsec connection. - IKE Crypto.
- IPsec Crypto.
Information about IPsec tunnel gateway IPsec VPN connection on Palo Alto. - IP tunnel on Palo Alto: 169.254.60.150/30.
- MTU: 1427.
- IP tunnel on AWS: 169.254.60.148/30.
Configure IKE Gateways.
Configure firewall zones
Create Zone:
We need to create zones for VPN connections.
To create go to Network > Zones.
Click Add and create the following information:
We need to create zones for VPN connections.
To create go to Network > Zones.
Click Add and create the following information:
- 01Name: VPN
- 02Type: Layer3
- 03Click OK.
Click Commit and OK to save the configuration changes.
Create Address Object
We will create the Address Object for the 2 LAN layers of the Palo Alto Firewall and AWS devices.
To create go to Object > Addresses.
Click Add and create according to the following parameters.
Palo Alto Firewall LAN:
To create go to Object > Addresses.
Click Add and create according to the following parameters.
Palo Alto Firewall LAN:
- Name: PA_LAN.
- Type: IP Netmask - 10.146.41.0/24.
- Click OK.
AWS LAN: - Name: AWS_LAN.
- Type: IP Netmask - 172.31.32.0/20.
- Click OK.
Click Commit and OK to save the configuration changes.
Configure the tunnel interface and virtual router
To create go to Network > Interface > Tunnel.
Click Add and create according to the following information:
Config tab:
Click Add and create according to the following information:
Config tab:
- Interface Name: tunnel.2
- Virtual Router: None
- Security Zone: VPN
- Click OK.
IPv4 tab: - Click Add and enter the tunnel IP 169.254.60.150/30 that we got from the previous config file.
Advanced tab: - We enter MTU as 1427, this parameter is taken from the config file downloaded from AWS.
Click Commit to save the configuration changes
Create Virtual Routers
To create Virtual Routers go to Network > Virtual Routers > click Add and configure according to the following information.
Tab Router Settings:
Name: VR1 Tab General: Click Add and select the vlan ports (LAN port), ethernet1/1 (internet port) and tunnel.2 (the tunnel used to connect VPN).
Tab Static Routes > IPv4
Click Add to add static routes and fill in the following information:
Tab Router Settings:
Name: VR1 Tab General: Click Add and select the vlan ports (LAN port), ethernet1/1 (internet port) and tunnel.2 (the tunnel used to connect VPN).
Tab Static Routes > IPv4
Click Add to add static routes and fill in the following information:
- 01Name: Route_AWS_Subnet.
- 02Destination: enter AWS LAN subnet as 172.31.32.0/20.
- 03Interface: tunnel.2.
- 04Next Hop: IP Address and enter the AWS tunnel IP is 169.254.60.148
- 05Click OK twice to save.
Click Commit and OK to save the configuration changes.
Configure IKE Crypto
We will create IKE Crypto ie Phase 1 for VPN connection.
To create, go to Network > IKE Crypto click Add and create according to the following information:
To create, go to Network > IKE Crypto click Add and create according to the following information:
- Name: vpn-0009b589f526268e7-0
- DH Group: group2
- Encryption: aes-128-cbc
- Authentication: sha1
- Key Lifetime: Seconds - 28800
- Click OK.
Click Commit and OK to save the configuration changes.
Create IPsec Crypto
To create IPsec Crypto go to Network > IPsec Crypto and click Add.
Configure according to the following parameters:
Configure according to the following parameters:
- 01Name: IPsec-crypto-profiles IPsec-vpn-0009b589f526268e7-0
- 02IPsec Protocol: ESP
- 03Encryption: aes-128-cbc
- 04Authentication: sha1
- 05DH Group: group2
- 06Lifetime: Seconds - 3600
- 07Click OK.
Click Commit and OK to save the configuration changes.
Configure the IKE gateway
To create go to Network > IKE Gateways and click Add.
Based on the IKE Gateway parameters that we have from the config file downloaded from AWS.
If we use IKEv2 only mode, enter the parameters of IKEv2 only mode, if we use IKEv2 preferred mode, enter the parameters of IKEv2 preferred mode.
In this article we will use IKEv2 only mode.
Configure according to the following parameters
General:
Based on the IKE Gateway parameters that we have from the config file downloaded from AWS.
If we use IKEv2 only mode, enter the parameters of IKEv2 only mode, if we use IKEv2 preferred mode, enter the parameters of IKEv2 preferred mode.
In this article we will use IKEv2 only mode.
Configure according to the following parameters
General:
- Name: ike-vpn-0009b589f526268e7-0
- Version: IKEv2 only mode
- Address Type: IPv4
- Interface: ethernet1/1 (Palo Alto Firewall's WAN port)
- Local IP Address: None
- Peer Address: Enter AWS WAN IP as 13.59.106.76
- Authentication: Pre-shared Key
- Pre-shared key: enter the connection password from the config file.
- Confirm Pre-shared key: re-enter the connection password.
- Local Identification: select IP address and enter Palo Alto Firewall's WAN IP as 113.161.x.x.
- Peer Identification: select the IP address and enter the AWS WAN IP as 13.59.106.76.
Advanced Options: - IKE Crypto Profile: select vpn-0009b589f526268e7-0.
- Click OK.
Click Commit and OK to save the configuration changes.
Configure the IPsec Tunnels
Now we will start creating a VPN connection with AWS.
To create go to Network > IPsec Tunnels and click Add.
Create with the following information:
To create go to Network > IPsec Tunnels and click Add.
Create with the following information:
- 01Tab General:
- 02Name: ipsec-tunnel-1
- 03Tunnel Interface: tunnel.2
- 04Type: Auto Key
- 05Address Type: IPv4
- 06IKE Gateways: ike-vpn-0009b589f526268e7-0
- 07IPsec Crypto Profile: IPsec-vpn-0009b589f526268e7-0
Tab Proxy IDs:
Click Add and configure the following information: - 08Proxy ID: Proxy-1
- 09Local: 10.146.41.0/24
- 10Remote: 172.31.32.0/20
- 11Protocol: Any
- 12Click ok twice to save.
Click Commit and OK to save the configuration changes.
Configure security policies
Create separate security rules for the required traffic in each direction. Specify the approved source and destination zones, networks, and applications. Review the rules before committing the configuration.
- Name: LAN_TO_VPN
- Rule Type: universal (default)
Tab Source: - Source Zone: click Add and select Trust-Layer3 zone
- Source Address: click Add and select PA_LAN
Tab Destination: - Destination Zone: VPN
- Destination Address: AWS_LAN
Tab Action: - Action: select Allow
- Click OK
Next, we will click Add and create a policy that allows traffic to go from the AWS LAN subnet to the Palo Alto Firewall's LAN subnet with the following information:
Tab General: - Name: VPN_TO_LAN
- Rule Type: universal (default)
Tab Source: - Source Zone: click Add and select VPN zone
- Source Address: click Add and select AWS_LAN
Tab Destination: - Destination Zone: Trust_Layer3
- Destination Address: PA_LAN
Tab Action: - Action: select Allow.
- Click OK.
Click Commit and OK to save the configuration changes.
Validate AWS connectivity
Check the VPN connection and tunnel status in AWS. Test an approved path between the intended hosts, then review firewall traffic logs. Confirm the return route as well as the forward route.
Separate SonicWall examples
Local SonicWall and Azure example
Configure site-to-site VPN with local SonicWall to Azure VM
Configure the local SonicWall:
To configure the interfaces:
1 In SonicOS on the local SonicWall, go to Network > Interfaces.
2 Edit port5. Set the role to WAN and set an IP/Network Mask of 192.168.5.1/255.255.255.0. This is for the interface connected to the Internet.
3 Edit port4. Set the role to LAN and set an IP/Network Mask of 172.16.200.1/255.255.255.0. This is for the interface connected to the local subnet.
To configure a static route to connect to the Internet:
1 Go to Network > Static Routes.
2 Click Create New.
3 Set the Destination to 0.0.0.0/0.0.0.0.
4 For the Interface, select port5.
5 Set the Gateway Address to 192.168.9.254.
To configure IPsec VPN:
- Go to VPN > IPsec Wizard.
- Click Create New.
1 Enter the desired VPN name. In the example, this is "to_cloud".
2 For Template Type, select Site to Site.
3 For the Remote Device Type, select SonicWall.
4 For NAT Configuration, select This site is behind NAT. For non dial-up situations where your local SonicWall has a public external IP address, you must choose No NAT between sites.
5 Click Next.
Configure Authentication:
1 For Remote Device, select IP Address.
2 Enter an IP address of 40.115.111.31, which is the Azure SonicWall's port1 public IP address.
3 For Outgoing Interface, select port5.
4 Set the Authentication Method to Pre-shared Key.
5 Enter a pre-shared key of 123456.
6 Click Next.
Configure Policy & Routing:
1 For Local Interface, select port4.
2 SonicOS automatically populates Local Subnets with 172.16.200.0/24.
3 Set the Remote Subnets to 10.58.1.0/24, which is the Azure SonicWall's port2 subnet.
4 For Internet Access, select None.
5 Click Create.
Configuring the Azure SonicWall:
To configure the interface:
1 In SonicOS on the Azure SonicWall, go to Network > Interfaces.
2 Edit port2. Set the role to LAN and set an IP/Network Mask of 10.58.1.4/255.255.255.0. This is for the interface connected to the Azure local subnet.
To configure IPsec VPN:
- Go to VPN > IPsec Wizard.
- Configure VPN Setup:
1 Enter the desired VPN name. In the example, this is "to_local".
2 For Template Type, select Site to Site.
3 For the Remote Device Type, select SonicWall.
4 For NAT Configuration, select This site is behind NAT. For non dial-up situations where your local SonicWall has a public external IP address, you must choose No NAT between sites.
5 Click Next.
Configure Authentication:
1 For Incoming Interface, select port1.
2 Set the Authentication Method to Pre-shared Key.
3 Enter a pre-shared key of 123456.
4 Click Next.
Configure Policy & Routing:
1 For Local Interface, select port2.
2 SonicOS automatically populates Local Subnets with 10.58.1.0/24.
3 Set the Remote Subnets to 172.16.200.0/24, which is the local SonicWall's port4 subnet.
4 For Internet Access, select None.
5 Click Create.
To bring up the VPN tunnel on the local SonicWall:
The tunnel is down until you initiate connection from the local SonicWall.
1 In SonicOS on the local SonicWall, go to Monitor > IPsec Monitor.
2 Click the to_cloud tunnel.
3 Click Bring Up to bring up the VPN tunnel.
SonicWall and AWS example
Configure site-to-site VPN with local SonicWall to AWS
To create a VPG:
1 A VPG is the VPN concentrator on the Amazon side of the site-to-site VPN connection. You can create a VPG and attach it to the VPC from which you want to create the site-to-site VPN connection.
2 In the AWS management console, go to Virtual Private Gateways, then click Create Virtual Private Gateway.
3 In the Name tag field, enter the desired gateway name.
4 For static route configuration, the ASN is not important, as the ASN is for BGP routing. By default, the VPG is created with the default ASN, 64512. You cannot change the ASN once the VPG has been created.
5 After creating the VPG, select it from the list of VPGs, and click Actions > Attach to VPC.
6 On the Attach to VPC page, select the ID for the desired VPC from the VPC dropdown list.
To create a customer gateway:
1 Go to Customer Gateways, then click Create Customer Gateway.
2 In the Name field, enter the desired gateway name.
3 For Routing, select Static.
4 In the IP Address field, enter the on-premise SonicWall's external address.
To create a site-to-site VPN connection on AWS:
1 Internet Key Exchange version 2 (IKEv2)
2 NAT traversal
3 Four-byte ASN (in addition to two-byte ASN)
4 Reusable IP addresses for customer gateways
5 Additional encryption options including AES 256-bit encryption, SHA-2 hashing, and additional Diffie-Hellman groups
6 Configurable tunnel options
7 Custom private ASN for the Amazon side of a BGP session
8 This example describes creating an IPsec site-to-site VPN.
9 Go to VPN Connections, then click Create VPN Connection.
10 In the Name tag field, enter the desired VPN connection name.
11 From the Virtual Private Gateway dropdown list, select the VPG ID for the VPG created earlier.
12 For Routing Options, select Static.
13 In the IP Prefixes field, enter the CIDR of the networks behind your on-premise SonicWall.
14 Leave the tunnel options blank. You will obtain this information from a configuration file download.
To configure the on-premise SonicWall:
1 After creating the VPN, select it in the VPN list, then click Download Configuration. This document contains information needed to configure the SonicWall correctly.
2 You can configure the SonicWall using this downloaded configuration file. Run the diagnose vpn tunnel up examplephase2 command if the tunnel is not up automatically already.
3 Check in the SonicOS GUI in VPN > IPsec Tunnels that the tunnel is up.
4 In the AWS management console, check that the tunnel is up.
5 After the tunnel is up, you must edit a custom route table and security group rules to achieve connectivity between a resource behind the SonicWall to a resource on the AWS cloud.
6 On AWS, there are two tunnels for each created VPN. This example only shows connecting to one tunnel, but you can create the second tunnel in SonicOS as well. The second tunnel is for redundancy. If one tunnel goes down, the SonicWall can reach AWS resources using the other tunnel.
SonicWall and Google Cloud example
Configuring site-to-site VPN between GCP and SonicWall
- On the remote site 1 SonicWall, go to VPN > IPsec Tunnels, then click Create New.
- On the VPN Setup tab, configure the following:
1 For Template type, select Site to Site.
2 For NAT configuration, select No NAT between sites.
3 Click Next.
On the Authentication tab, configure the following:
1 In the Remote IP address field, enter the destination SonicWall public IP address. This is the spoke1 public IP address.
2 Configure a signature ore pre-shared key to secure the tunnel.
3 Click Next.
- On the Policy & Routing tab, configure the local and remote subnets. Note that here, the local subnet refers to the remote site subnet, and the remote subnet refers to the NCC external and internal VPC subnets. Click Next.
- Review the configuration, then click Create.
- Create a similar connection from the Region 1 spoke SonicWall to the remote site 1 SonicWall. When creating this connection, on the Policy & Routing tab, ensure that you add port1 and port2 as local interfaces when creating the tunnel interface.
Loading...