topic Re: On-demand ipsec tunnels? in General Topics

On-demand ipsec tunnels?

SDorsey — Thu, 04 Sep 2014 12:25:15 GMT

Is it possible in the PAN to do on-demand vpn tunnels? This is used quite a bit in the Cisco world.. especially for vendors.

They often are setup so the tunnel is configured but when the vendor needs to connect for support, the end-user needs to connect to their ASA and initiate the tunnel basically.

Re: On-demand ipsec tunnels?

VinceM — Thu, 04 Sep 2014 14:51:45 GMT

Hi,

Today you can't disable a VPN in a PA. The only thing you can do is to delete your tunnel

I know there are many request for that. May be introduce in 6.1 version.

Hope help.

Re: On-demand ipsec tunnels?

HULK — Thu, 04 Sep 2014 14:54:51 GMT

Hello mackwage,

Are you talking about site to site IPSec VPN tunnel...? The PAN firewall will bring the IPSec VPN tunnel upon interesting traffic by default.

Thanks

Re: On-demand ipsec tunnels?

SDorsey — Thu, 04 Sep 2014 16:03:26 GMT

HULK Get out of here with that "interesting traffic" terminology. That is Cisco jargon. :smileylaugh:

Thanks for the help!

Re: On-demand ipsec tunnels?

mharding — Thu, 04 Sep 2014 16:11:29 GMT

I control ours by a security policy using two external IP addresses, and disable/enable the security policy as needed.

Re: On-demand ipsec tunnels?

ajbool — Thu, 04 Sep 2014 16:40:37 GMT

Could try something of the form,

* Configure your security policies such that only outgoing VPN connections are accepted.

* Configure the VPN as passive.

When you need the VPN, on the CLI use the 'test vpn ipsec-sa tunnel <name>' command to bring the session up.

It may not work; but it would be what I'd try to achieve that...

Re: On-demand ipsec tunnels?

VinceM — Wed, 12 Nov 2014 13:00:30 GMT

Hi all,

What I looking for is a "ON/OFF switch" for site to site IpSec tunnel.

Seem it's not possible neither in 6.0 nor in 6.1 ...

Thx for all your answer

Re: On-demand ipsec tunnels?

hshah — Wed, 12 Nov 2014 14:09:14 GMT

Hi SDorsey,

VPN Tunnel is initiated in two circumstances.

1. In case of interested traffic. >>>>>>>>>>>>>Sorry for Cisco Jargon.

2. By using a Test vpn command.

Now it stays up until SAs life time. Cisco also behaves in exactly same way.

If there is a traffic than it stays up and remains up until SA expires. Inbetween if you want to terminate it than clear flows.

Could you please tell me more specific information on "On demand" word.

Regards,

Hardik Shah