topic Re: migration ipsec rsa vpn from juniper ssg in General Topics

migration ipsec rsa vpn from juniper ssg

mathsss — Fri, 12 Feb 2016 14:46:29 GMT

Hello all,

There is 2 juniper firewalls.side to side between them.Side A and Side B

I'm going to change side A with Paloalto and for sideB change configuration is not allowed.

So everything is ok except for vpn.inside juniper phase 1 profile is selected as preddefined Rsa(rsa-g2-3des-sha sig), so what will I do on paloalto ?

Thanks.

Re: migration ipsec rsa vpn from juniper ssg

bmorris1 — Fri, 12 Feb 2016 15:44:01 GMT

Hi Mathsss,

I would advise you review this article in conjunction with what you currently have configured. That way you can match up the settings with those of the peer.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-IPSec-VPN/ta-p/56535

hope this helps!,

Ben

Re: migration ipsec rsa vpn from juniper ssg

OtakarKlier — Fri, 12 Feb 2016 16:35:50 GMT

Hello,

Here are a couple of other articles that may help out.

https://live.paloaltonetworks.com/t5/Configuration-Articles/PanOS-to-Juniper-SRX-Route-Based-VPN-with-OSPF/ta-p/53112

https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-for-Configuring-a-Juniper-SRX-IPSEC-VPN-Tunnel-to-a-Palo/ta-p/61287

Regards,

Re: migration ipsec rsa vpn from juniper ssg

mathsss — Fri, 12 Feb 2016 19:03:28 GMT

Thanks.but nothing related to my question here.

Re: migration ipsec rsa vpn from juniper ssg

mathsss — Fri, 12 Feb 2016 19:04:12 GMT

Thanks but not any word about rsa here.

Re: migration ipsec rsa vpn from juniper ssg

mathsss — Sat, 13 Feb 2016 09:24:39 GMT

Hello

any idea 😞 ?

Re: migration ipsec rsa vpn from juniper ssg

Retired Member — Sun, 14 Feb 2016 12:49:42 GMT

Based on what I know, PAN does not use RSA keys to sign tunnels, which the SSG appears to be doing. Unfortunately you have no choice but to modify those settings. I would recommend using the most secure settings possible in order to appease your stakeholders.

Take care,