topic Re: Ipsec VPN to Cisco ASA in General Topics

Ipsec VPN to Cisco ASA

cfpa — Wed, 23 May 2012 14:47:20 GMT

Hi Guys,

right now we are trying to setuop a ipsec vpn between out palo alto 4.0.7 box and a cisco asa 8.2 box ..

Cause we are running into troubles whithin the ike setup, i would like to know the following:

1. How can i debug the vpn setup in the pa ? I'm used to ASA's but this is my first vpn setup on a PA. I want to check why the tunnel does not come up (i did the setup regarding to the documentation)

2. I found the follwing as fixed in the release note of 4.1.6:

39844 – IPSec VPN tunnel not coming up when Palo Alto Networks firewall initiates a connection to a Cisco ASA device.

Is it possible that im hitting that bug ? In which software version was this bug introduced ?

Many thanks,
Christian

Re: Ipsec VPN to Cisco ASA

bstapleton — Wed, 23 May 2012 16:09:22 GMT

You should see log entries including attempts to make connections in Monitor-->Logs-->System

To test a IPSec tunnel, from the command line on the PA,

clear vpn ike-sa gateway <name of IKE Gateway in Network-->Network Profiles-->IKE Gateways>

clear vpn ipsec-sa tunnel <name of IPSec tunnel in Network-->IPSec Tunnels>

test vpn ipsec-sa tunnel <name of IPSec tunnel in Network-->IPSec Tunnels>

We've only encountered bug #39844 in PAN-OS version 4.1.5.

Re: Ipsec VPN to Cisco ASA

zarina — Wed, 23 May 2012 16:25:55 GMT

This document https://live.paloaltonetworks.com/docs/DOC-1328 gives a sample configuration between PAN and Cisco ASA.

You can also look at the ike manager logs to get more info:

less mp-log ikemgr.log

Re: Ipsec VPN to Cisco ASA

cfpa — Thu, 24 May 2012 14:11:48 GMT

Hi,

thanks for both answers.

After reading the guide und checking the logs the vpn tunnel is up and running now.

The asa admin disabled the isakmp keepalive settings at his box and i configured a proxy id in the ipsec tunnel cause the asa uses policy-based vpns instead of rotue based vpn's.

Many thanks for your helps.

Best regards,

Christian