Ipsec VPN to Cisco ASA

[cfpa]

Hi Guys,

right now we are trying to setuop a ipsec vpn between out palo alto 4.0.7 box and a cisco asa 8.2 box ..

Cause we are running into troubles whithin the ike setup, i would like to know the following:

1. How can i debug the vpn setup in the pa ? I'm used to ASA's but this is my first vpn setup on a PA. I want to check why the tunnel does not come up (i did the setup regarding to the documentation)

2. I found the follwing as fixed in the release note of 4.1.6:

39844 – IPSec VPN tunnel not coming up when Palo Alto Networks firewall initiates a connection to a Cisco ASA device.

Is it possible that im hitting that bug ? In which software version was this bug introduced ?

Many thanks,
Christian

[bstapleton]

You should see log entries including attempts to make connections in Monitor-->Logs-->System

To test a IPSec tunnel, from the command line on the PA,

clear vpn ike-sa gateway <name of IKE Gateway in Network-->Network Profiles-->IKE Gateways>

clear vpn ipsec-sa tunnel <name of IPSec tunnel in Network-->IPSec Tunnels>

test vpn ipsec-sa tunnel <name of IPSec tunnel in Network-->IPSec Tunnels>

We've only encountered bug #39844 in PAN-OS version 4.1.5.

[zarina]

This document  https://live.paloaltonetworks.com/docs/DOC-1328 gives a sample configuration between PAN and Cisco ASA.

You can also look at the ike manager logs to get more info:

less mp-log ikemgr.log

[cfpa]

Hi,

thanks for both answers.

After reading the guide und checking the logs the vpn tunnel is up and running now.

The asa admin disabled the isakmp keepalive settings at his box and i configured a proxy id in the ipsec tunnel cause the asa uses policy-based vpns instead of rotue based vpn's.

Many thanks for your helps.

Best regards,

Christian