You can only form IPsec VPN's over the WAN IP's of an MX.  So if both firewalls exist next to eachother behind an upstream router then you could easily have an IPsec VPN between them even if their WAN IP's are in the RFC1918 range. However if the Palo Alto is at the LAN side of the MX you will be out of luck. ... View more