# Route-Based IPsec VPN to Palo Alto

> Route-Based Site-to-Site IPsec VPN между VyOS и Palo Alto firewall - настройка VTI интерфейсов, IKEv2 параметры и динамическая маршрутизация через туннель

Source: https://opennix.org/docs/vyos/examples/vpn-paloalto/


Route-Based IPsec VPN с VTI (Virtual Tunnel Interface) между VyOS и Palo Alto Networks firewall для flexible routing и dynamic protocols support.

## Сценарий

- Enterprise Hybrid Cloud: Yandex/VK Cloud ↔ On-premises Palo Alto
- Dynamic Routing: BGP/OSPF через VPN tunnel
- Multi-Site connectivity

## VyOS Configuration

```bash
# VTI Interface
set interfaces vti vti1 address '10.255.255.1/30'

# IKE + ESP Groups
set vpn ipsec ike-group IKE-PA key-exchange 'ikev2'
set vpn ipsec ike-group IKE-PA proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-PA proposal 1 hash 'sha256'

set vpn ipsec esp-group ESP-PA proposal 1 encryption 'aes256'

# Peer
set vpn ipsec site-to-site peer 203.0.113.1 authentication pre-shared-secret 'PSK'
set vpn ipsec site-to-site peer 203.0.113.1 vti bind 'vti1'
```

## Ссылки

- [VyOS VTI](https://docs.vyos.io/en/latest/configuration/interfaces/vti.html)
- [Palo Alto VPN Docs](https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/vpns)