PAN-OS 10.1 and Later &

Prisma Access (Panorama Managed)

Create a new IPSec profile.
Select
Network
Network Profiles
IPSec Crypto
and select
Add
.
Enter a
Name
for the new profile.
Select the
IPSec Protocol
—ESP or AH—that you want to apply to secure the data as it traverses across the tunnel.
As a best practice, select ESP (Encapsulating Security Payload) over AH (Authentication Header) because ESP offers both confidentiality and authentication for the connection whereas AH offers only authentication.
Click
Add
and select the
Authentication
and
Encryption
algorithms for ESP, and
Authentication
algorithms for AH, so that the IKE peers can negotiate the keys for the secure transfer of data across the tunnel.
If you aren’t certain of what the IKE peers support, add multiple algorithms in the order of most-to-least secure as follows; the peers negotiate the strongest supported algorithm to establish the tunnel:
Encryption—
aes-256-gcm
,
aes-256-cbc
,
aes-192-cbc
,
aes-128-gcm
,
aes-128-ccm
(the VM-Series firewall doesn’t support this option),
aes-128-cbc
,
des
,
3des
.
PAN-OS 10.1.0 and earlier releases support the Data Encryption Standard (DES) encryption algorithm.
As a best practice, choose the strongest authentication and encryption algorithms the peer can support. For the authentication algorithm, use SHA-256 or higher (SHA-384 or higher preferred for long-lived transactions). Don’t use SHA-1, MD5, or none. For the encryption algorithm, use AES; 3DES is weak and vulnerable.
Authentication—
sha512
,
sha384
,
sha256
,
sha1
,
md5
.
Select the DH Group to use for the IPSec SA negotiations in IKE phase 2.
From
DH Group
, select the key strength you want to use:
group1
,
group2
,
group5
,
group14
,
group15
,
group16
,
group19
,
group20
, or
group21
. For the highest security, choose the group with the highest number.
Beginning with PAN-OS 10.2.0 and later releases,
group15
,
group16
, and
group21
Diffie-Hellman (DH) groups are supported.
If you don’t want to renew the key that the firewall creates during IKE phase 1, select
no-pfs
(no perfect forward secrecy); the firewall reuses the current key for the IPSec security association (SA) negotiations.
Specify the duration of the key—time and volume of traffic.
Using a combination of time and traffic volume allows you to ensure safety of data.
Select the
Lifetime
or time period for which the key is valid in seconds, minutes, hours, or days (range is 3 minutes to 365 days). When the specified time expires, the firewall will renegotiate a new set of keys.
Select the
Lifesize
or volume of data after which the keys must be renegotiated.
Commit your IPSec profile.
Click
OK
and click
Commit
.
Attach the IPSec Profile to an IPSec tunnel configuration.
See Set up key exchange.