Arista vEOS, Configuration Manual, Page: 108 / 128

6. Create a new IPsec tunnel, and select the tunnel interface, IKE gateway, IKE crypto profile, and IKE crypto
profile defined earlier in the procedure. Selecting these elements binds them to the new tunnel interface.
Note: Enter the destination IP address of the tunnel interface of the vEOS Router in the Destination
IP option (one of the Tunnel Monitor settings on the Palo Alto firewall VM).
7. Create a new static route for the network that is behind the remote tunnel endpoint. This new static route
ensures that the traffic flows through the tunnel to the other tunnel endpoint.
8.
Commit
(save) the configuration.
vEOS and Palo Alto Firewall VM Pairing (VTI IPsec Tunnel)
The following example shows a VTI IPsec tunnel between a vEOS Router instance and a third party Palo Alto
firewall VM router instance.
Running Configuration for vEOS1
ip security
ike policy ikebranch1
integrity sha256
dh-group 15
!
sa policy sabranch1
sa lifetime 2
pfs dh-group 14
!
profile hq
ike-policy ikebranch1
sa-policy sabranch1
connection add
shared-key keyAristaHq
dpd 10 50 clear
!
interface Ethernet1
no switchport
ip address 1.0.0.1/24
!
interface Management1
ip address dhcp
!
interface Tunnel1
mtu 1404
ip address 1.0.3.1/24
tunnel mode ipsec
tunnel source 1.0.0.1
tunnel destination 1.0.0.2
tunnel ipsec profile hq
!
Running Configuration on Palo Alto Firewall VM
"ike": {
"crypto-profiles": {
"ike-crypto-profiles": [
{
"@name": "veos12-IKE-Phase1",
"hash": {
"member": "sha512"
vEOS Router Configuration Guide 108