topic Re: IPSEC VPN - app-id in General Topics

IPSEC VPN - app-id

roma — Mon, 28 Mar 2022 19:19:44 GMT

Hello all,

We have a software ipsec connection that will be between an inside server and a server in the cloud. The PA will just be a pass through so to speak, (nating and security rule).

The ipsec requires UDP 500 and 4500 and the IP 50 protocol. Do you know which app-id's I'll need for that?

The palo has these 4 app-id's:

ike tcp/500, udp/500

ipsec-ah - nothing

ipsec-esp - nothing

ipsec-esp-udp - udp/4500, udp/4501

I don't see anything for IP 50, is there?

Also, since I'm using app-id, do I leave the service still as "application-default"?

Thanks.

Re: IPSEC VPN - app-id

JoergSchuetter — Mon, 28 Mar 2022 20:26:36 GMT

The file /etc/protocols on a Linux system has (among others) the following lines:

esp 50 IPSEC-ESP # Encap Security Payload [RFC2406]
ah 51 IPSEC-AH # Authentication Header [RFC2402]

My experience is that ipsec-{esp,ah} matches ip protocols 50 and 51

Re: IPSEC VPN - app-id

rmfalconer — Mon, 28 Mar 2022 20:27:04 GMT

esp is protocol 50. If you look at the details of ipsec-esp, you'll see the 50 defined.

All protocols have a number. For example, tcp is 6 and udp is 17.

If you select the ipsec application, it should be fine to leave as application-default.