# Route-Based IPsec VPN to Palo Alto

> Route-based site-to-site IPsec VPN between VyOS and a Palo Alto firewall - VTI interface setup, IKEv2 parameters, and dynamic routing over the tunnel

Source: https://opennix.org/en/docs/vyos/examples/vpn-paloalto/


Route-based IPsec VPN with a VTI (Virtual Tunnel Interface) between VyOS and a Palo Alto Networks firewall for flexible routing and dynamic protocol support.

## Scenario

- Enterprise Hybrid Cloud: Yandex/VK Cloud ↔ On-premises Palo Alto
- Dynamic Routing: BGP/OSPF over the VPN tunnel
- Multi-Site connectivity

## VyOS Configuration

```bash
# VTI Interface
set interfaces vti vti1 address '10.255.255.1/30'

# IKE + ESP Groups
set vpn ipsec ike-group IKE-PA key-exchange 'ikev2'
set vpn ipsec ike-group IKE-PA proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-PA proposal 1 hash 'sha256'

set vpn ipsec esp-group ESP-PA proposal 1 encryption 'aes256'

# Peer
set vpn ipsec site-to-site peer 203.0.113.1 authentication pre-shared-secret 'PSK'
set vpn ipsec site-to-site peer 203.0.113.1 vti bind 'vti1'
```

## References

- [VyOS VTI](https://docs.vyos.io/en/latest/configuration/interfaces/vti.html)
- [Palo Alto VPN Docs](https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/vpns)