PAN-SEC-093MediumPAN-OS

Enabled IPSec tunnel has no route into it

Base severity

Medium

Area

IPSec VPN

Platform

PAN-OS

Evidence level

Derived0.90

Benchmark reference

Reads the export, not the device

ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.

Why it matters

A route-based tunnel carries only what is routed into its tunnel interface, and no route points there. Unless a routing protocol learns a route into it, the partner's networks are reached some other way or not at all.

How to fix it

Web interface

The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.

If the tunnel is in service, add a static route for each remote network with the tunnel interface as the egress, or run the routing protocol the partner expects over it.
If the tunnel is retired, disable or delete it, with its gateway and the rules that name its zone.

PAN-OS CLI

set network virtual-router <virtual-router> routing-table ip static-route <new-route-name> destination <remote-network>set network virtual-router <virtual-router> routing-table ip static-route <new-route-name> interface <tunnel-interface>

An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits. Review the candidate configuration, then commit it yourself.

Read it back

show network virtual-router <virtual-router> routing-table ip static-route

Values to fill in4

<virtual-router>: The virtual router
<tunnel-interface>: The tunnel interface to change
<new-route-name>: A name for the new route
<remote-network>: A network at the far end of the tunnel

Before you type it1

Add the route only if the tunnel is in service. If it is retired, disable it instead, with the rules that name its zone.

How to confirm the fix

Confirm the routing table lists the remote networks on the tunnel interface.
Confirm a test flow to the remote network leaves through the tunnel.

Limits

A route a routing protocol learns from a peer on another interface can reach the tunnel without any line here naming it.

Compliance references

No benchmark recommendation is mapped to this control in this version.

See it on your own firewall

One complete analysis of one firewall costs nothing. A card is required and nothing is charged.

Start a free analysis