topic Do I configure proxy-id in ipsec-vpn certainly? in General Topics

Do I configure proxy-id in ipsec-vpn certainly?

KiCheon.Lee — Tue, 23 Apr 2013 08:56:05 GMT

Hello all,

What is proxy-id in ipsec-vpn configuration??

Why does it need??

I will use ipsec-vpn on PA-2020 & PA-500.

Each devices have 15 proxy-id(remote-networks).

I know one tunnel interface has 10 proxy-ids.

So I have tested without proxy-id that traffics are processed routing-table(next-hop tunnel interface) to 15 remote-networks.

It is normal. Do I configure proxy-id in ipsec-vpn certainly??

What problem does it has if I configure ipsec-vpn without proxy-id???

Or please let me know if you know other good way.

Thanks.

Re: Do I configure proxy-id in ipsec-vpn certainly?

UhMayYeah — Tue, 23 Apr 2013 10:27:54 GMT

What is proxy-id in ipsec-vpn configuration??Why does it need??

A proxy-IDs are negotiated during Phase II tunnel establishment and define the Traffic that needs to be Encrypted or the Interested Traffic for an IPSEC tunnel.
Policy Based VPN define this using a combination of SRC IP, DST IP, and SERVICES in a tunnel policy. (Eg : Security Rules in Juniper for Policy Based VPNs or ACLs in Cisco).
Route Based VPN use a logical L3 tunnel interface ,traffic destined for the Tunnel is Encrypted and use 0.0.0.0/0 as Proxy IDs by default.

PA firewalls use Route Based approach hence Proxy-IDs are manually configured On PA firewalls only while connecting with Policy Based VPNs to match the ones configured on the Peer.

Terminology

(ACL :: CISCO || PROXY IDs :: Juniper || Encryption Domains :: CHKPOINT)

So the behavior observed is NORMAL and You do not need to configure Proxy IDs for Establishing IPSEC between PA firewalls.

Re: Do I configure proxy-id in ipsec-vpn certainly?

KiCheon.Lee — Tue, 23 Apr 2013 11:44:55 GMT

Wow, Thanks a million for your detail answer.

Must not between PA devices be configured proxy-ids?

And must PA device be configured proxy-id when connect policy based vpn such as Cisco , Juniper , CHKPOINT by ipsec-vpn????

Is it right???

Re: Do I configure proxy-id in ipsec-vpn certainly?

UhMayYeah — Tue, 23 Apr 2013 11:49:04 GMT

Yes thts Right.

No Proxy Ids between 2 PA s

But only for Policy Based VPN using Peer ,in short for Cross Vendor VPNs

Ameya

Re: Do I configure proxy-id in ipsec-vpn certainly?

KiCheon.Lee — Tue, 23 Apr 2013 12:02:48 GMT

Thank you very much, Ameya.

I am helpful for you answer.