topic Re: S2S VPN between PA 3020 8.0 to Cisco ASA 9.x code. in General Topics

S2S VPN between PA 3020 8.0 to Cisco ASA 9.x code.

brian.schroeder — Thu, 05 Apr 2018 23:40:46 GMT

First thing,

I know there are postings about this out on the web and community about this. The problem I'm having is everything out there is on old ASA code.

I'm trying to understand the configuration on the PA. I have my tunnel interface configured, IKE Crypto, IPSec Crypto, IKE Gateway, and IPSec Tunnel. I can't get the Phase 1 to come up. I've verified the DH Groups, Authentication, and Encryption setting are the same on both sides. Can someone point me in a direction where they think my problem might be?

Thanks for any help given,

Re: S2S VPN between PA 3020 8.0 to Cisco ASA 9.x code.

santonic — Fri, 06 Apr 2018 10:11:25 GMT

Checking (and posting) logs would be a good start.

Re: S2S VPN between PA 3020 8.0 to Cisco ASA 9.x code.

BPry — Fri, 06 Apr 2018 15:30:34 GMT

@brian.schroeder,

Did you verify that your proxy-ids are setup correctly. As @santonic stated logs would be the thing that will tell you what's actually happening.

Re: S2S VPN between PA 3020 8.0 to Cisco ASA 9.x code.

brian.schroeder — Fri, 06 Apr 2018 15:31:38 GMT

I'll be pulling those soon.

Re: S2S VPN between PA 3020 8.0 to Cisco ASA 9.x code.

brian.schroeder — Fri, 06 Apr 2018 15:35:16 GMT

So that's one of the things I was needing to understand.

Am I creating a PID for every host that has access over the tunnel?

Or does a subnet range work for this?

On the ASA side I have an ACL just allowing a few host to access the tunnel.

Re: S2S VPN between PA 3020 8.0 to Cisco ASA 9.x code.

BPry — Fri, 06 Apr 2018 15:45:13 GMT

@brian.schroeder,

Cisco is policy-based while the Palo Alto is route-based. The Palo Alto is essentially defaulting to 0.0.0.0/0 source and 0.0.0.0/0 destiantion. If they don't match things aren't going to form correctly. You can use a network range as long as that's what the ASA is sending; if they don't match you'll still have an issue.

Here's two good articles about proxy-ids HERE and HERE.

Re: S2S VPN between PA 3020 8.0 to Cisco ASA 9.x code.

Raido_Rattameister — Fri, 06 Apr 2018 15:54:26 GMT

Initiate vpn traffic from ASA side and check logs on Palo.

Monitor > System

If you can't identify issue yourself then share logs here.

Re: S2S VPN between PA 3020 8.0 to Cisco ASA 9.x code.

santonic — Mon, 09 Apr 2018 06:57:49 GMT

ACL for crypo-map on Cisco and Proxy IDs on PA must match for VPN to work. While PA isn't too strict about exact matches, policy based FWs like ASA usually are.

But check logs first, you will find the answer there.