How to Configure IPsec Tunnel with Palo Alto and Zscaler ZIA [Experience Center].

Section 1: Configuration at ZIA End

A. Configure VPN Credentials

Navigation: Infrastructure > Location Resources > VPN Credentials

• Click on “Add VPN Credentials”
• Authentication Type: FQDN
• Set the User ID (refer to screenshot below)
• Select the Cloud Domain (refer to screenshot below)
• Set the Pre-Shared Key: Example@224

Click Save.

Figure 1 – ZIA: Add VPN Credential dialog (FQDN authentication selected)

B. Configure Locations

Navigation: Infrastructure > Location Management > Legacy Locations

• Click on “Add Location”
• Enter a descriptive Name for the location
• Choose the Country
• Select the City
• Set the Timezone
• Set Location Type to “Corporate User Traffic”
• Select the VPN Credentials created in step A
• Leave all remaining settings at their default values

Click Save.

Figure 2 – ZIA: Add Location dialog with VPN Credentials assigned

C. Activate the Changes

After saving the location, activate all pending changes to push the configuration live.

Figure 3 – ZIA: Activate button highlighted in the top-right toolbar

✅ ZIA-side configuration is now complete.

Section 2: Palo Alto Configuration

A. Create IKE Crypto and IPsec Crypto Profiles

In this scenario, the default IKE Crypto and IPsec Crypto profiles are used. No custom profiles need to be created unless your security policy requires specific algorithms.

Figure 4 – Palo Alto: Default IKE Crypto (top) and IPsec Crypto (bottom) profiles selected

B. Obtain the Peer IP Address

• Visit the Zscaler configuration portal:
• https://config.zscaler.com/<your-cloud>/center
• Select your Zscaler cloud and navigate to Cloud Enforcement Node Ranges.
• Identify the VPN Host Name of the nearest node.
• Resolve the VPN hostname from the Palo Alto firewall CLI using ping or nslookup:
• ping <VPN-hostname>
• Record the resolved IP address — this will be used as the Peer IP in the IKE Gateway.

Figure 5 – Zscaler Cloud Enforcement Node Ranges: selecting the nearest VPN Host Name

Figure 6 – Palo Alto CLI: resolving the VPN hostname via ping to obtain the Peer IP

C. Configure the IKE Gateway in Palo Alto

• Navigate to Network > Network Profiles > IKE Gateways and click Add.
• Enter a Name for the gateway (e.g., IPSEC-GRE).
• Set the Interface to the appropriate WAN interface (e.g., ethernet1/1).
• Set Peer IP Address Type to IP and enter the resolved Peer IP from step B.
• Set Authentication to Pre-Shared Key and enter:
• Example@224
• Set Local Identification to “User FQDN (email address)” and enter the FQDN configured in ZIA.
• Under Advanced Options, select IKEv2 preferred mode and apply the default IKE Crypto Profile.

Click OK.

Figure 7 – Palo Alto: IKE Gateway configuration (General and Advanced Options tabs)

D. Create the Tunnel Interface

• Navigate to Network > Interfaces > Tunnel and click Add.
• Under the Config tab, assign the interface to the appropriate Virtual Router and Security Zone (e.g., IPSEC).
• Optionally assign an IP address on the IPv4 tab (e.g., 192.168.1.2/24) for monitoring purposes.

Click OK and commit if required.

Figure 8 – Palo Alto: Tunnel Interface assigned to Virtual Router ‘default’ and Security Zone ‘IPSEC’

E. Create the IPsec Tunnel

• Navigate to Network > IPsec Tunnels and click Add.
• Enter a Name (e.g., IPSEC-GRE).
• Assign the Tunnel Interface created in step D.
• Set the IKE Gateway to the gateway created in step C.
• Set the IPsec Crypto Profile to default.
• Under the Proxy IDs tab — leave all Proxy IDs blank (Zscaler uses route-based VPN).

Click OK.

Figure 9 – Palo Alto: IPsec Tunnel configuration (General tab and empty Proxy IDs tab)

F. Create a Security Policy (if required)

• If traffic from the untrusted interface to the untrusted zone is not permitted by default, create a security policy to explicitly allow it:
• Navigate to Policies > Security and click Add.
• Set Source Zone and Destination Zone both to OFFTRUSTED (or as applicable).
• Set Action to Allow.
• Scope the destination address to the Zscaler Peer IP (e.g., 165.225.120.38/24) for tighter control.

Commit the change.

Figure 10 – Palo Alto: Security policy permitting OFFTRUSTED → OFFTRUSTED traffic to Zscaler peer

G. Verify Tunnel Status

If the IPsec tunnel does not come up automatically, log in to the Palo Alto device via CLI and run the following diagnostic commands:

test vpn ipsec-sa

test vpn ike-sa

These commands initiate IPsec SA and IKE SA negotiations. If multiple tunnels are configured, refer to the vendor documentation or query an AI assistant for tunnel-specific command syntax.

Figure 11 – Palo Alto CLI: running ‘test vpn ipsec-sa’ and ‘test vpn ike-sa’

Section 3: Tunnel is UP — Verification

Once the IPsec tunnel is established, both the Palo Alto firewall and the ZIA portal will show the tunnel as active. The screenshots below confirm a successful connection.

Palo Alto Side

The IPsec Tunnels view in Palo Alto shows the tunnel status as active (green indicator) with Tunnel Info available.

Figure 12 – Palo Alto: IPsec Tunnels list showing IPSEC-GRE tunnel as active (green status)

ZIA Side

In the Zscaler ZIA portal (Data Explorer > Tunnel Insights), IPsec IKEv2 Phase 1 and Phase 2 events are logged, and the Tunnel Status confirms the tunnel is UP.

Figure 13 – ZIA Data Explorer: Tunnel Insights showing IPsec IKEv2 Phase 1 & 2 events with TUNNEL_IPSEC_IKEV2_UP status

Moreover, thank you for reading this; I hope it helped you.

💬 Have questions or need support? You can reach us directly Prince Kumar & Mohit Sharma

We have extensive hands-on experience with the following technologies:

• 🔵 Zscaler ZIA / ZPA
• 🔥 Palo Alto NGFW & Prisma Access
• 🌐 CloudGenix SD-WAN (Palo Alto)
• 🛡️ Fortinet
• 🔗 Cisco