From the Local IP Address drop-down, select the IP address that the VPN connection will use as the endpoint.

Select the physical, outgoing Interface on the firewall where the local gateway resides.

Set the Version to IKEv2 only mode and the Address Type to IPv4.

Create a meaningful name for the gateway.

Navigate to Network > Network Profiles > IKE Gateways and click Add.

Then, VPN Peer A establishes the VPN tunnel using the IPsec Crypto profile, which defines the IKE phase 2 parameters to allow the secure transfer of data between the two sites. If the security policy permits the connection, VPN Peer A uses the IKE Crypto profile parameters (IKE phase 1) to establish a secure connection and authenticate VPN Peer B. When a client that is secured by VPN Peer A needs content from a server located at the other site, VPN Peer A initiates a connection request to VPN Peer B. The following figure shows a VPN tunnel between two sites. The SAs specify all of the parameters that are required for secure transmission- including the security parameter index (SPI), security protocol, cryptographic keys, and the destination IP address- encryption, data authentication, data integrity, and endpoint authentication.

IKE uses digital certificates or preshared keys, and the Diffie Hellman (DH) keys to set up the SAs for the IPsec tunnel.

The Internet Key Exchange (IKE) process is used to authenticate the VPN peers, and IPsec Security Associations (SAs) are defined at each end of the tunnel to secure the VPN communication. After successful authentication, the peers negotiate the encryption mechanism and algorithms to secure the communication. In order to set up the VPN tunnel, first the peers need to be authenticated.

Palo alto vpn setup