ike policy

[infotech]

What part of the configuration on the PA matching what is called the ike policy on the Cisco?

[hshah]

Hello Infotech,

It can be configured on following location. Let me know if you have further questions.

Regard,

Hardik Shah

[HULK]

Hello Infotech,

Ike policy defines different security parameter you are using for your IKE profile. On PAN firewall it's IKE-crypto.

Once, you will configure the IKE profile, then as a second step, you need to configure a IKE-gateway. It will included local IP, peer IP, exit interface, preshared key, Peer ID type etc.

Hope this helps.

Thanks

[infotech]

There seem to be more than one policy on the ike policies on the cisco how do I know which one matches the PA?

[HULK]

Hello Infotech,

During the phase 1 negotiation, both gateways will exchange their IKE-crypto details and the common profile would be chosen for tunnel.

Thanks

[HULK]

Hello Infotech,

You may configure Max 3 IKE-crypto profile on PAN and at least one should be matched with CISCO.

Thanks

[infotech]

Unless there is des setup on the cisco and it doesn't appear to be available on the PA.

[hshah]

Hi Infotech,

DES is not secure, we only support 3DES and above protocols.

Regards,

Hardik Shah

[infotech]

I understand that but the cisco is old and I think it may have that option still trying to figure out what ike policy and priorities are and how they relate to the PA

[HULK]

PAN firewall supports bellow mentioned encryption technology for IPsec Phase 1 negotiation:

Thanks

[infotech]

Are you saying that aes128 is compatible with des?

[HULK]

No, i mean to say, you have following option to choose for IKE-encryption. It should be identical on both gateways ( PAN---- Cisco).

Thanks

[infotech]

Unless you want to set the PA to does and that option is not available

[HULK]

Since PAN does not support DES, you need to change CISCO IKE-crypto policy accordingly.

Thanks

[infotech]

Yeah there is one part I the cisco side I am trying to verify. The ike policies look like they match but there is something called ike policy priority and I am not 100% sure how to verify that