>
    Strata Copilot
    Arista VeloCloud SD-WAN Solution Guide
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access
    3. Integrate Third-Party SD-WANs with Prisma Access
    4. Arista VeloCloud SD-WAN Solution Guide
    Download PDF
    Prisma Access

    Arista VeloCloud SD-WAN Solution Guide

    Table of Contents

    Arista VeloCloud SD-WAN Solution Guide

    Learn to integrate Arista SDWAN (formerly VMware SD-WAN) by VeloCloud in Prisma Access.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Strata Cloud Manager)
    • Prisma Access (Managed by Panorama)
    • Prisma Access license
    • Subnets you will use for each remote network gateway
    • IP address of the VeloCloud SD-WAN device. You use the IP address of the gateway address to configure the IKE gateway. Obtain this information from the VeloCloud SD-WAN Orchestrator.
    The following sections describe how you use the Arista (formerly VMware) VeloCloud SD-WAN with Prisma Access:

    Supported IKE and IPSec Cryptographic Profiles

    The following table documents the IKE/IPSec crypto settings that are supported with Prisma Access and VeloCloud devices. Use the recommended settings when you onboard a remote network and define IKE and IPSec cryptographic settings when connecting the Prisma Access and VeloCloud device.
    A check mark indicates that the profile or architecture type is supported; a dash (—) indicates that it is not supported. Default and Recommended settings are noted in the table. 
    Crypto ProfilesPrisma AccessVeloCloud
    Tunnel TypeIPSec Tunnel
    √
    √
    GRE Tunnel——
    RoutingStatic Routes
    √
    √
    Dynamic Routing (BGP)
    √
    		—
    Dynamic Routing (OSPF)——
    IKE VersionsIKE v1
    √
    √
    IKE v2
    √
    √
    IPSec Phase 1 DH-GroupGroup 1
    √
    √
    Group 2
    √
    (Default)
    √
    Group 5
    √
    √
    Group 14
    √
    √
    Group 19
    √
    		—
    Group 20
    √
    (Recommended)    		—
    IPSec Phase 1 Auth
    If you use IKEv2 with certificate-based authentication, only SHA1 is supported in IKE crypto profiles (Phase 1).
    		MD5
    √
    √
    SHA1
    √
    (Default)
    √
    SHA256
    √
    √
    SHA384
    √
    		—
    SHA512
    √
    (Recommended)    		—
    IPSec Phase 1 EncryptionDES
    √
    		—
    3DES
    √
    (Default)    		—
    AES-128-CBC
    √
    (Default)
    √
    AES-192-CBC
    √
    		—
    AES-256-CBC
    √
    (Recommended)
    √
    IPSec Phase 1 Key Lifetime Default
    √
    (8 Hours)
    √
    (24 Hours)
    IPSec Phase 1 Peer AuthenticationPre-Shared Key
    √
    √
    Certificate
    √
    		—
    IKE Peer IdentificationFQDN
    √
    √
    IP Address
    √
    		—
    User FQDN
    √
    		—
    IKE PeerAs Static Peer
    √
    √
    As Dynamic Peer
    √
    		—
    OptionsNAT Traversal
    √
    √
    Passive Mode
    √
    √
    Ability to Negotiate TunnelPer Subnet Pair
    √
    		—
    Per Pair of Hosts
    √
    		—
    Per Gateway Pair
    √
    		—
    IPSec Phase 2 DH-GroupGroup 1
    √
    		—
    Group 2
    √
    (Default)
    √
    Group 5
    √
    √
    Group 14
    √
    √
    Group 19
    √
    		—
    Group 20
    √
    (Recommended)    		—
    No PFS
    √
    		—
    IPSec Phase 2 AuthMD5
    √
    √
    SHA1
    √
    (Default)
    √
    SHA256
    √
    √
    SHA384
    √
    		—
    SHA512
    √
    (Recommended)    		—
    None
    √
    		—
    IPSec Phase 2 EncryptionDES
    √
    		—
    3DES
    √
    (Default)    		—
    AES-128-CBC
    √
    (Default)
    √
    AES-192-CBC
    √
    		—
    AES-256-CBC
    √
    √
    AES-128-CCM
    √
    		—
    AES-128-GCM
    √
    		—
    AES-256-GCM
    √
    (Recommended)    		—
    NULL
    √
    		—
    IPSec ProtocolESP
    √
    √
    AH
    √
    		—
    IPSec Phase 2 Key Lifetime Default
    √
    (1 Hour)
    √
    (8 Hour)
    Tunnel Monitoring FallbackDead Peer Detection (DPD)
    √
    √
    ICMP——
    Bidirectional Forwarding Detection (BFD)——
    SD-WAN Architecture TypeWith Regional Hub/Gateway/Data CenterN/A
    √
    No Regional Hub/Gateway/Data CenterNA
    √

    SD-WAN Deployment Architectures Supported by Arista VeloCloud SD-WAN

    The VeloCloud SD-WAN supports the following deployment architectures for use with Prisma Access. a dash (—) indicates that the deployment is not supported.
    Use CaseArchitectureSupported?
    Securing traffic from each branch site with 1 WAN link (Type 1)
    √
    Securing branch and HQ sites with active/backup SD-WAN connections
    √
    Securing branch and HQ sites with active/active SD-WAN connections
    —
    Securing branch and HQ sites with SD-WAN edge devices with a primary and secondary tunnel
    √
    Securing SD-WAN deployments with Regional Hub/POP architecture (Type 2)
    √

    © 2026 Palo Alto Networks, Inc. All rights reserved.