topic Re: VPN tunnel between ASA 5505 and PA 3020 in General Topics

VPN tunnel between ASA 5505 and PA 3020

infotech — Fri, 23 May 2014 17:13:12 GMT

I am trying to create a vpn tunnel betetween a ASA 5505 and PA 3020 and it keeps giving me IKEv2 error but I don't even have that enabled. What is the best way to do this type of VPN tunnel?

Re: VPN tunnel between ASA 5505 and PA 3020

HULK — Fri, 23 May 2014 17:38:43 GMT

Hello Infotech,

Please find below doc, which might help you. By the way, IKE V2 currently it is not supported. However, there is a feature request previously submitted. (FR ID: 1683). I would request you to set IKEv1 on your CISCO ASA to successfully build the VPN tunnel with PAN.

Sample IPSec Tunnel Configuration - Palo Alto Networks Firewall to Cisco ASA

IPSEC with Cisco ASA

Thanks

Re: VPN tunnel between ASA 5505 and PA 3020

infotech — Fri, 23 May 2014 18:07:09 GMT

My ASA was never configured for IKEv2 I'm not sure why it is giving that error. Where do you set the nat 0?

Re: VPN tunnel between ASA 5505 and PA 3020

HULK — Fri, 23 May 2014 19:30:25 GMT

Hello Infotech,

The ASA might be taking IKE version 2 by default. Could you please verify, if there is any option to disable it. The option would be available under Phase-1 configuration.

Thanks

Re: VPN tunnel between ASA 5505 and PA 3020

HULK — Fri, 23 May 2014 19:33:52 GMT

FYI....

See Sample ASA Configuration on the mentioned link:

Site-to-Site IKEv2 Tunnel between ASA and Router Configuration Examples - Cisco

Book 3: Cisco ASA Series VPN CLI Configuration Guide, 9.1 - Configuring IPSec and ISAKMP [Cisco ASA 5500-X Series Next-G…

Thanks

Re: VPN tunnel between ASA 5505 and PA 3020

infotech — Fri, 23 May 2014 19:42:05 GMT

I have confirmed that IKEv2 is not configured but it looks like it tries the ikev1 and it doesn't work.

Re: VPN tunnel between ASA 5505 and PA 3020

HULK — Fri, 23 May 2014 19:48:00 GMT

Hello Infotech,

Could you please share SYSTEM logs from PAN FW here. It will give us some clue and point of failure.

Thanks

Re: VPN tunnel between ASA 5505 and PA 3020

infotech — Fri, 23 May 2014 19:53:57 GMT

Sure how would you like to receive them?

Re: VPN tunnel between ASA 5505 and PA 3020

HULK — Fri, 23 May 2014 21:32:38 GMT

Thanks for your time Infotech,

At last, we identified as "No proposal chosen" for Phase-1 IKE.