IPSec S2S VPN between Palo Alto and 3rd party Security FW Vendor -> ISAKMP Negotiation

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

IPSec S2S VPN between Palo Alto and 3rd party Security FW Vendor -> ISAKMP Negotiation

L0 Member

Hi,

 

I am trying to setup a Site to Site VPN between a Palo Alto FW and a 3rd Party Security FW Vendor;

 

I would like to undestand under which condition the Palo Alto FW would attempt to start an ISAKMP negotiation (for Phase 1) with the IPSec peer counterpart.

 

I'm familiar with the Cisco ASA setup - where, for ex., the tunnel is brought up only when interesting traffic is actually attempting to flow through the Unit -> how is the behavior in the case of the PA ?

 

Does the unit attempt to start the IPSEC tunnel automatically as soon as the config is pushed / committed (also without any interesting traffic hitting the unit) ?

Is this is the case, assuming that the tunnel could not be successfully established on the 1st attempt, does the PA attempt periodically to perform the ISAKMP negotiation ?

 

I haven't labbed this scenario yet (planning on doing) - nevertheless any heads up would be appreciated.

 

Thanks

 

1 accepted solution

Accepted Solutions

L6 Presenter

It's been my experience that as long as the tunnel peers can communicate the "tunnel Info" icon will come up, but if no "interesting traffic" is going down the tunnel then the icon for the "IKE Info" will show down.

 

Here's an example from one of my FWs

 

 Tunnels.PNG

View solution in original post

1 REPLY 1

L6 Presenter

It's been my experience that as long as the tunnel peers can communicate the "tunnel Info" icon will come up, but if no "interesting traffic" is going down the tunnel then the icon for the "IKE Info" will show down.

 

Here's an example from one of my FWs

 

 Tunnels.PNG

  • 1 accepted solution
  • 2446 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!