migration ipsec rsa vpn from juniper ssg

[mathsss]

Hello all,

There is 2 juniper firewalls.side to side between them.Side A and Side B

I'm going to change side A with Paloalto and for sideB change configuration is not allowed.

So everything is ok except for vpn.inside juniper phase 1 profile is selected as preddefined Rsa(rsa-g2-3des-sha  sig), so what will I do on paloalto ?

Thanks.

[bmorris1]

Hi Mathsss,

I would advise you review this article in conjunction with what you currently have configured. That way you can match up the settings with those of the peer.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-IPSec-VPN/ta-p/56535

hope this helps!,

Ben

[OtakarKlier]

Hello,

Here are a couple of other articles that may help out.

https://live.paloaltonetworks.com/t5/Configuration-Articles/PanOS-to-Juniper-SRX-Route-Based-VPN-wit...

https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-for-Configuring-a-Juniper-SRX-IPSEC-VPN-...

Regards,

[mathsss]

Thanks.but nothing related to my question here.

[mathsss]

Thanks but not any word about rsa here.

[mathsss]

Hello

any idea 😞 ?

[akurt]

Based on what I know, PAN does not use RSA keys to sign tunnels, which the SSG appears to be doing. Unfortunately you have no choice but to modify those settings. I would recommend using the most secure settings possible in order to appease your stakeholders.

Take care,

AK