How to Configure IPSec VPN on PAN firewall

Steps

1. Go to Network > Tunnel Interface to create a new tunnel interface and assign the following parameters:
   Name: tunnel.1
   Virtual router: (select the existing virtual router)
   Zone: (select the layer 3 internal zone from which the traffic will originate)
   
   Note: If the tunnel interface is in a zone that is different from the zone that the traffic will originate/depart, then a policy will need to be created to allow the traffic to flow from the source zone to the zone containing the tunnel interface.
   
   
2. Go to Network > Network Profiles > IKE Crypto Profile and define IKE Crypto (IKEv1 Phase-1) parameters.
   These parameters should match on the remote firewall for the IKE Phase-1 negotiation to be successful.
   
   
3. Go to Network > Network Profiles > IKE Gateway to configure the IKE Phase-1 Gateway.

Note: The Tunnel configured above will terminate in the Trust zone for traffic traversing the tunnel, although if more granular control is desired for the policy configuration in the tunnel use a VPN or other zone. Also, note that the gateway configuration below will be configured for the Untrust interface and not to be confused with the tunnel terminating on a trusted interface.

1. Under Network > Network Profiles > IPSec Crypto Profile define IPSec Crypto profile to specify protocols and algorithms for identification, authentication, and encryption in VPN tunnels based on IPSec SA negotiation (IKEv1 Phase-2). These parameters should match on the remote firewall for the IKE Phase-2 negotiation to be successful.
   
   
2. Under Network > IPSec Tunnel > General configure IPSec Tunnels to set up the parameters to establish IPSec VPN tunnels between firewalls.
   
   Note:  If the other side of the tunnel is a third party VPN device configured as a policy-based VPN, then enter the local proxy ID and remote proxy ID to match the other side.
   
   When configuring an IPSec Tunnel Proxy-ID configuration to identify local and remote IP networks for traffic that is NATed, the Proxy-ID configuration for the IPSec Tunnel must be configured with the Post-NAT IP network information since the Proxy-ID information defines
   the networks that will be allowed through the tunnel on both sides for the IPSec configuration.
   
   
3. Under Network > Virtual Routers-Static Route add a new route for the network that is behind the other VPN endpoint.
   
4. Commit the configuration.