topic Re: Proxy ID in General Topics

Proxy ID

infotech — Thu, 17 Jul 2014 19:19:02 GMT

How can you tell what proxy ID's need to be configured on a PA that has VPN tunnels to a Cisco ASA 5505?

Re: Proxy ID

hshah — Thu, 17 Jul 2014 19:33:14 GMT

Hello Infotech,

You need to collect that information from Cisco ASA administrator. You can follow bellow link form more details.

Sample IPSec Tunnel Configuration - Palo Alto Networks Firewall to Cisco ASA

Regards,

Hardik Shah

Re: Proxy ID

HULK — Thu, 17 Jul 2014 19:34:12 GMT

Hello Infotech,

You have to select the PROXY ID as, Local subnet behind PAN firewall ( where from you are expecting traffic to pass through VPN tunnel) and remote subnet (behind CISCO) FW.

For an example:

PAN local SUbnet: 192.168.1.0/24

Remote subnet:172.16.1.0/24

On the CISCO FW access list, you have to configure just in opposite direction:

PAN local SUbnet: 172.16.1.0/24

Remote subnet:192.168.1.0/24

Hope this helps.

Thanks

Re: Proxy ID

HULK — Thu, 17 Jul 2014 19:37:15 GMT

Few more related discussions for your reference:

Proxy ID's question

Proxy ID Mismatch

Why is a Proxy-ID Required for VPNs between PAN and Firewalls that Support Policy Based VPNs?

Thanks

Re: Proxy ID

HULK — Thu, 17 Jul 2014 19:53:30 GMT

An example:

Hope it will help you to understand about proxy ID's.

Thanks

Re: Proxy ID

infotech — Thu, 17 Jul 2014 20:00:48 GMT

I will check that out

Re: Proxy ID

infotech — Thu, 17 Jul 2014 20:04:38 GMT

What if the proxy ids on the cisco side are really being used do you still have to add them to the PA?

Re: Proxy ID

HULK — Thu, 17 Jul 2014 20:07:26 GMT

Yes, you need to configure the PROXY ID's on PAN firewall. Based on the proxy ID's, PAN firewall will create the SPI (keys).

Thanks

Re: Proxy ID

infotech — Thu, 17 Jul 2014 20:09:08 GMT

I don't understand what you are saying.

Re: Proxy ID

HULK — Thu, 17 Jul 2014 20:15:26 GMT

For an example:

Result of show vpn flow tunnel-id

tunnel Parkway_IPSec_Tunnel5:DR_Network

id: 139

type: IPSec

gateway id: 5

local ip: 66.94.196.107

peer ip: 66.94.196.108

inner interface: tunnel.5

outer interface: ethernet1/3

state: inactive

session: 0

tunnel mtu: 1428

lifetime remain: N/A

monitor: off

monitor packets seen: 0

monitor packets reply: 0

en/decap context: 2716

local spi: 9C3025F2 >>>>>>>>>>>>>>>>>>>>>>>>>>> based on below mentioned Local/Remote subnet, this SPI keys will generate. If you do not enter any proxy ID's,it will take 0.0.0.0/0 as local and remote and SPI will mismatch with CISCO FW.

remote spi: 07B3DE31 >>>>>>>>>>>>>>>>>>>>>>>>>>

key type: auto key

protocol: ESP

auth algorithm: NOT ESTABLISHED

enc algorithm: NOT ESTABLISHED

proxy-id local ip: 10.135.100.0/24 ******************************

proxy-id remote ip: 10.135.11.0/25 ******************************

proxy-id protocol: 0

proxy-id local port: 0

proxy-id remote port: 0

SPI is just like a KEY, to open and encrypt a packet. IF you check CISCO FW it should have the same SPI keys for this VPN tunnel.

On CISCO FW:

local spi: 07B3DE31 ( remote for PAN)

remote spi: 9C3025F2 ( Local for PAN)

Thanks

Re: Proxy ID

hshah — Thu, 17 Jul 2014 20:17:54 GMT

Hi Infotech,

PROXY ID is mendatory configuration on ASA, they must have configured it.

Get proxy ID from then and reverse it for PAN Configuration.

Proxy ID on ASA

1.1.1.0/24 to 2.2.2.0/24

Then PAN Proxy ID

2.2.2.0/24 to 1.1.1.0/24

Regards,

Hardik Shah

Re: Proxy ID

pulukas — Thu, 17 Jul 2014 21:22:36 GMT

As hshah mentions the proxy-id are a required configuration on the ASA. Unfortunately, the Cisco configuration does not call them proxy-id. Rather the Cisco engineer will know them as the vpn ACL or interesting traffic ACL.

These are simply the subnet on the Cisco side and the subnet on the PA side. The trick is they must exactly match.

Ask your Cisco partner what his vpn ACL contains.

Sample:

The fist ip address is the ASA side and the second is the PAN side:

access-list PanACL extended permit ip 192.168.1.0 255.255.252.0 192.168.2.0 255.255.0.0

Re: Proxy ID

hshah — Thu, 17 Jul 2014 21:23:28 GMT

They also call it crypto ACL.

Re: Proxy ID

infotech — Fri, 18 Jul 2014 14:58:28 GMT

So what if the proxy id's on the cisco side aren;t really subnets that are used in order to make both sides match do you still have to add them to the PA side?
Seems like if they did not match the tunnel would not come up at all.

Re: Proxy ID

HULK — Fri, 18 Jul 2014 15:30:58 GMT

If the PROXY ID did not match on both sides, Phase-1 will come UP but IPSec phase-2 will fail with an error "proxy ID mismatch".

Thanks

Re: Proxy ID

infotech — Fri, 18 Jul 2014 15:37:05 GMT

I am not getting a proxy id mismatch error I am getting no proposal chosen for phase 2 and phase 1 works fine

Re: Proxy ID

HULK — Fri, 18 Jul 2014 15:42:32 GMT

Could you please double check Phase-2 ( ipsec) proposals are same on both sides. Please select only one set of proposal on both side firewalls.

Also check in ike-mgr log: admin@> tail follow yes mp-log ikemgr.log

Thanks

Re: Proxy ID

infotech — Fri, 18 Jul 2014 15:46:39 GMT

I have checked this more times than I can count but here it is

ipsec crypto
settings on PA

encryption -aes256

authentication -sha1

DH group - group1

lifetime 8 hours

lifesize – 4800 mb

Cisco 5505 ipsec
crypto settings

encryption-AES256

Authentication -sha

DH - group1

SA lifetime settings - 8 hours

Traffic volume -4608000 KB

Re: Proxy ID

HULK — Fri, 18 Jul 2014 15:50:35 GMT

Could you please run > tail follow yes mp-log ikemgr.log---------- from CLI and at the same time, apply test VPN command from an another SSH window. Please share the o/p with us.

Thanks

Re: Proxy ID

infotech — Fri, 18 Jul 2014 15:55:06 GMT

Sorry I thought I entered that information earlier in this post, the tunnel is currently up and running but should failed later this afternoon