topic Re: IPsec Tunnel in General Topics

IPsec Tunnel

jdprovine — Thu, 19 Apr 2018 18:52:36 GMT

This might be a dumb question but I am going to ask it anyway, otherwise I may never know. I want to replace an ASA 5510 firewall IPsec VPN into a PCI network using Palo alto. What is the best way to approach that?

Re: IPsec Tunnel

BPry — Thu, 19 Apr 2018 19:13:32 GMT

@jdprovine,

I imagine that the tunnel is currently just using a pre-shared key? If that's the case you would simply be able to recreate the tunnel on the PA and you shouldn't run into any issues.

Re: IPsec Tunnel

jdprovine — Thu, 19 Apr 2018 19:23:49 GMT

@BPry

I would assume the current VPN tunnle is using a pre-shared key also, I didn't set it up, just trying to find out how it is working now and see if I can mimic it on the PA. Then find out what VPN client can connect to it.

Re: IPsec Tunnel

jdprovine — Fri, 20 Apr 2018 13:41:18 GMT

Can you use L2TP ?

Re: IPsec Tunnel

BPry — Fri, 20 Apr 2018 13:43:34 GMT

@jdprovine,

No. L2TP is no longer a feature for the vast majority of appliances anymore.

Re: IPsec Tunnel

jdprovine — Fri, 20 Apr 2018 13:58:04 GMT

@BPry

I was afraid of that, its going to make VPN client they can use more difficult, some people need to have a vpn client for access from home and also a client to access the PCI network. Like me I have a native client configured for PCI access and the GP VPN because, though you can switch back and forth by changing the portal name, it would be easier if you could have multiple entries on one client

The setting for the VPN for the client for the ASA 5510 are L@TP/IPSec with pre-shared key

Re: IPsec Tunnel

BPry — Fri, 20 Apr 2018 13:57:42 GMT

@jdprovine,

You actually can do this within the new agent. You would simply add another portal within the agent settings, and then you can toggle between the portals when you connect.

Re: IPsec Tunnel

jdprovine — Fri, 20 Apr 2018 13:59:29 GMT

@BPry

Which version client it that and does it work with 7.1.15

Re: IPsec Tunnel

BPry — Fri, 20 Apr 2018 14:26:48 GMT

@jdprovine,

It's the 4.1 client. While the 4.1 will work with 7.1.15 I would make sure that it's fully functional in your enviroment before you push it out in mass.

Re: IPsec Tunnel

jdprovine — Fri, 20 Apr 2018 14:29:16 GMT

@BPry

Nice to see that they are answering our feature requests. I am going to install it on my test laptop and see how it works. This is going to be very helpful

Re: IPsec Tunnel

jdprovine — Fri, 20 Apr 2018 15:01:25 GMT

@BPry

Works like a dream on my test machine!!! I love it. Now I just have to figure out how to setup my IPSec tunnel, with the settings from the old ASA 5510