topic Re: Cisco ASA to PaloAlto VPN conversion in General Topics

Cisco ASA to PaloAlto VPN conversion

rswauger — Tue, 06 Aug 2013 19:05:08 GMT

Has anyone developed step by step instructions for migrating site to site VPN's from a Cisco ASA to a PaloAlto 2050?

I have approximately 30 VPN's to convert and currently running in VWire mode so all the VPN's will need to be added prior to moving off VWire and eliminating the Cisco.

Any help would be appreciated as far as best practices.

Thanks in advance.

Re: Cisco ASA to PaloAlto VPN conversion

kprakash — Tue, 06 Aug 2013 19:17:26 GMT

Please contact your Sales Engineer or the Dev Centre team to assist you with the migration. In order for you to run the VPNs on the PANFW, you have to convert the vwire to layer 3 interface mode.

Best regards,

Karthik RP

Re: Cisco ASA to PaloAlto VPN conversion

rswauger — Wed, 07 Aug 2013 11:14:04 GMT

I understand that the vpn's could not be active until we get off of VWire mode, but we are a hospital operating 24/7 with data continually being sent over these tunnels.

I need to have these tunnels generated on the PaloAlto in advance of moving off of VWire so that when I move the cables over to production these tunnels go live with a minimum of effort.

Thanks

Randy

Re: Cisco ASA to PaloAlto VPN conversion

kprakash — Wed, 07 Aug 2013 12:33:22 GMT

Good Morning Randy,

You can configure multiple tunnel sub interface for each of the VPNs, assign them to a zone ( like VPN zone ), and configure routes for the remote networks behind each peer, via these tunnel sub interfaces. If the ASA is configured with the Virtual tunnel interfaces ( to use route based VPNs ), the migration should be pretty simple.

You then have to

a) Configure the untrust interface on the PANFW, through which the firewall will establish the tunnel, and transmit and receives the ESP packets. Configure a policy from untrust to untrust, permitting applications ike, ipsec ( and ciscovpn if the remote peers happen to be ASA devices )

b) Configure the trust interface/interfaces from where the internal hosts at the PANFW side are reachable on. Configure polices from Trust to VPN and also from VPN to Trust

BR,

Karthik

Re: Cisco ASA to PaloAlto VPN conversion

kprakash — Wed, 07 Aug 2013 12:57:27 GMT

You can refer to the below link, explaining the VPN configuration. You can also search our documentation on VPN configuration.

https://live.paloaltonetworks.com/docs/DOC-1163

Best regards,

Karthik