topic Upgrading site-to-site IPSec tunnel tunnel tonight - no PRF option in General Topics

Upgrading site-to-site IPSec tunnel tunnel tonight - no PRF option

abaskerville — Mon, 07 Feb 2022 20:22:22 GMT

We're upgrading a VPN tunnel to IKEv2 between a Cisco FTD 2140 and a PA-850 running 9.1. What I've noticed is that the PA doesn't have an option for PRF on phase 1. Does the PA automatically make this the same as the integrity algorithm? Is there some other way to configure this?

Thank you.

Re: Upgrading site-to-site IPSec tunnel tunnel tonight - no PRF option

S.Cantwell — Tue, 08 Feb 2022 15:51:30 GMT

From a simplicity perspective, the PRF is done internally within the PANW.

When creating the actual tunnel (IPSec tunnel menu item on the PANW), you can choose Manual Key, vs Auto Key

Re: Upgrading site-to-site IPSec tunnel tunnel tonight - no PRF option

abaskerville — Tue, 08 Feb 2022 17:57:39 GMT

FWIW, PRF was set to SHA256 on the Cisco FTD, and the tunnel negotiated with no problems. It was IKEv1 previously, so the transition went smoothly. Steve, thanks for your input.