S2S VPN between PA 3020 8.0 to Cisco ASA 9.x code.

[brian.schroeder]

First thing,

I know there are postings about this out on the web and community about this. The problem I'm having is everything out there is on old ASA code. 

I'm trying to understand the configuration on the PA. I have my tunnel interface configured, IKE Crypto, IPSec Crypto, IKE Gateway, and IPSec Tunnel. I can't get the Phase 1 to come up. I've verified the DH Groups, Authentication, and Encryption setting are the same on both sides. Can someone point me in a direction where they think my problem might be?

Thanks for any help given,

[santonic]

Checking (and posting) logs would be a good start.

[BPry]

@brian.schroeder,

Did you verify that your proxy-ids are setup correctly. As @santonic stated logs would be the thing that will tell you what's actually happening. 

[brian.schroeder]

I'll be pulling those soon.

[brian.schroeder]

So that's one of the things I was needing to understand.

Am I creating a PID for every host that has access over the tunnel?

Or does a subnet range work for this?

On the ASA side I have an ACL just allowing a few host to access the tunnel.

[BPry]

@brian.schroeder,

Cisco is policy-based while the Palo Alto is route-based. The Palo Alto is essentially defaulting to 0.0.0.0/0 source and 0.0.0.0/0 destiantion. If they don't match things aren't going to form correctly. You can use a network range as long as that's what the ASA is sending; if they don't match you'll still have an issue. 

Here's two good articles about proxy-ids HERE and HERE. 

[Raido_Rattameister]

Initiate vpn traffic from ASA side and check logs on Palo.

Monitor > System

If you can't identify issue yourself then share logs here.

[santonic]

ACL for crypo-map on Cisco and Proxy IDs on PA must match for VPN to work. While PA isn't too strict about exact matches, policy based FWs like ASA usually are. 

But check logs first, you will find the answer there.