Hello friends, welcome back—this is Day 38 of my PCNSA series, and in this video I go deeper into Palo Alto Site-to-Site VPN by explaining how the VPN tunnel is actually built. In my previous video I covered VPN basics like hashing and encryption, so here I focus on the real negotiation part: what components are required, what Phase 1 is, what IKE/ISAKMP means (same concept, different terms), and why Phase 2 is needed. I also explain Main Mode vs Aggressive Mode—Main Mode uses 6 messages and Aggressive uses 3, and in packet capture you can literally see which messages are clear text and which become encrypted. Then I break down Phase 1 step-by-step using the initiator/responder flow: encryption, hashing, authentication, and DH proposals go first, and if policies don’t match you’ll see “no matching policy” behavior. After that, Diffie-Hellman public keys are exchanged, both sides calculate the same shared key, and that key is used to encrypt the authentication part (pre-shared key or certificate) to verify you’re building VPN to the right device. Finally, I explain Phase 2 as the data phase—how your actual traffic gets encrypted/authenticated—plus why PFS (DH in Phase 2) adds an extra layer of security. I also cover the idea of rekey and lifetimes so keys keep changing over time without impacting users.