How To Do an IPSec VPN Configuration Between PAN Firewall and Cisco ASA
Darshan K. Doshi describes how to configure IPSec VPN between Palo Alto and Cisco ASA. Read more …
Notice: This blog post was originally published on Indeni before its acquisition by BlueCat.
The content reflects the expertise and perspectives of the Indeni team at the time of writing. While some references may be outdated, the insights remain valuable. For the latest updates and solutions, explore the rest of our blog
Key Takeaways
Step by Step Guide: IPSec VPN Configuration
Between a PAN Firewall and Cisco ASA
To keep your business online and ensure critical devices, such as Check Point firewalls, meet operational excellence standards it is helpful to compare your environment to a third party data set. As part of the Indeni Automation Platform, customers have access to Indeni Insight which benchmarks adoption of the Check Point capabilities and user behavior to adhere to ITIL best practices.
+++
Overview:
This document describes the step by step guide on how to configure IPSec VPN and assumes the Palo Alto Firewall has at least 2 interfaces in Layer 3 mode. If you find this article helpful check out how you can automate your PAN network with Indeni.
High Level Diagram:
IP schema specification:
Steps to be followed on Palo Alto Networks Firewall for IPSec VPN Configuration
Go to Network > Tunnel Interface to create a new tunnel interface and assign the following parameters:
Name: tunnel.1
Virtual router: default
Please refer this article if you need any help to configure Virtual Router on Palo Alto Networks.
Zone: (select the layer 3 internal zone from which the traffic will originate)
Please refer this article if you need any help to configure Layer 3 interface on Palo Alto Networks.
Note: If the tunnel interface is in a zone different from the zone where the traffic will originate or depart, then a policy will need to be created to allow the traffic to flow from the source zone to the zone containing the tunnel interface.
Configure IPSec Phase – 1 configuration
To Network > Network Profiles > IKE Crypto Profile and define IKE Crypto (IKEv1 Phase-1) parameters.
(These parameters must match on the Cisco ASA firewall for the IKE Phase-1 negotiation to be successful)
Related content
Your journey to intelligent NetOps begins at Cisco Live
Visit BlueCat’s booth or book a meeting now to learn more about how our solutions can help you build a network that supports constant change.
Replace BIND and ISC with Micetro DNS/DHCP Server (MDDS)
Tired of patching and manually configuring BIND DNS and ISC DHCP? Discover how Micetro MDDS appliances can replace them for modern DDI.
Automate it all in Integrity with REST v2 API-first DDI management
Discover API-first DDI with Integrity X by using REST v2 to automate DNS, DHCP, and IPAM for scalable, secure network operations.
Agentic AI adoption in network observability propels NetOps teams
Network observability is crucial for today’s networks and even more capable with agentic AI, according to new Omdia and BlueCat research.