- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
05-27-2016 11:07 AM
We have a business partner that wants to create an IPSec VPN tunnel with our PA-5050 using pre-shared keys, but they don't want to provide a Public IP address for us to peer with. Their other clients configure the remote peer address of 0.0.0.0 basically allowing any remote IP as a peer.
My spidey sense is telling me this is a bad idea. There's a big diffence between cracking a complex encryption algorithm and guessing a pre-shared key- something that dictionary attack can do in a resonable amount of time.
Am I being paranoid? Or is this a terrible idea?
Thanks for any comments.
Frank
05-27-2016 11:26 PM
Permitting incoming IPSec from any ip is used for example when branch office is behind DSL line and dynamic IP.
Then you configure aggressive mode and leave peer ip blank.
Yes it is slightly less secure as more data is sent over network before tunnel is established in clear text (Proxy ID's for example) but it is not unsecure either.
If you use good PSK then you can be pretty safe as if someone tries to connect to you and there is mismatch (crypto profile or PSK or Proxy ID etc) then responder sits silently and does not reveal what he did not like.
Palo supports up to 64 character PSK but double check what device is at other side.
I have seen limits like 29 etc in the past.
05-30-2016 11:00 PM
As far as I know Palo supports IPSec PSK's up to 255 characters with ASCII support.
Here are also some limitations with other vendors which I have been experiencing in the past:
Juniper:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&*()-_=+[{]}\|;:'<,.>/
MAX LENGTH: 127 CHARACTERS
Fortinet Fortigate:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
MAX LENGTH: 80 CHARACTERS
Cisco Systems:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
MAX LENGTH: 127 CHARACTERS
Checkpoint:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
MAX LENGTH: 64 CHARACTERS
Watchguard:
ASCII
MAX LENGTH: 63 CHARACTERS
Microsoft:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
MAX LENGTH: 128 CHARACTERS
PFSense:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
MAX LENGTH: 255 CHARACTERS (maybe even more)
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!