Use Predefined IPSec Templates to Onboard Service and Remote Network Connections
GlobalProtect cloud service includes predefined IPSec templates for common third-party IPSec and SD-WAN devices. These profiles expedite and simplify the onboarding of service connections and remote network connections that use one of these devices to terminate the connection.
Sharing a common template also allows you to Onboard Multiple Remote Network Connections of the Same Type with commonly-shared cryptos, pre-shared keys, and Peer identifiers.
Template Names and Types
GlobalProtect cloud service provides you with the following predefined templates that you can use to set up IPSec tunnels between your on-premise device and GlobalProtect cloud service:
- IPSec Tunnels (NetworkIPSec Tunnels) under Remote_Network_Template and Service_Conn_Template.
- IKE Gateways (NetworkNetwork ProfilesIKE Gateways) under Remote_Network_Template and Service_Conn_Template.
- IPSec Crypto Profiles (NetworkNetwork ProfilesIPSec Crypto) under Remote_Network_Template and Service_Conn_Template.
- IKE Crypto Profiles (NetworkNetwork ProfilesIKE Crypto) under Remote_Network_Template and Service_Conn_Template.
Currently, templates for the following vendors are available:
In addition to the following templates, we provide a Generic template that you can use with any on-premise device that is not listed here.
- Cisco appliances:
- Cisco Integrated Services Routers (ISRs)
- Cisco Adaptive Security Appliances (ASAs)
- Silver Peak
Use the following workflows to onboard service connections or remote network connections using the predefined IPSec templates.
Onboard a Service Connection or Remote Network Connection Using Predefined Templates
To onboard a service connection or remote network connection using the templates provided by GlobalProtect cloud service, complete the following task.
- In Panorama, perform configuration so that the templates
display in Panorama.When you upgrade the Cloud Services plugin, the new templates do not automatically display. Complete this step once after upgrading to have the templates permanently display. New installations perform this initial configuration as part of their first-time setup and this extra step is not required.You can also complete this step if you delete these templates and need to retrieve them.
- For service connections, select PanoramaCloud ServicesConfigurationService Setup, click the gear icon in the Settings area to open the Settings, then click OK.
- For remote network connections, select PanoramaCloud ServicesConfigurationRemote Networks, click the gear icon in the Settings area to open the Settings, then click OK.
- Select Network, then select the correct Template (either Remote_Network_Template if you are creating a remote network connection or Service_Conn_Template if you are creating a service connection).
- Determine the type of device that is used to terminate
the service connection or remote network connection, and find a
template to use with that device.If your SD-WAN or IPSec device is not on the list, use the generic profiles.
- Select NetworkNetwork ProfilesIKE Gateways and
make the following changes to the IKE gateway profile for your device:You can use the IPSec crypto and IKE crypto profiles with no changes; however, you must make specific changes to the IKE gateway profile to match the network settings.
- (Optional) If you know the public IP address of the on-premise device that will be used to set up the IPSec tunnel with GlobalProtect cloud service, set a static IP address by specifying a Peer IP Address Type of IP and enter the Peer Address for the IPSec tunnel.
- If using a pre-shared key for the IPSec tunnel, specify a Pre-shared Key.
- Specify a Peer Identification of either IP Address or User FQDN.Be sure that you match the settings you specify here when you configure the device used to terminate the other side of the IPSec tunnel.
- Onboard the Create a Service Connection or remote network connection, specifying the IPSec tunnel configuration that matches the device on the other side of the IPSec tunnel.
- (Optional) If you need to add a backup tunnel (Secondary
WAN) for a service connection or remote connection, perform the following
additional configuration steps.
- Create a new IKE Gateway for the backup
tunnel, copying the settings from the predefined template you want
to duplicate.The following example creates a backup tunnel configuration for generic networking devices.
- Under Advanced Options, specify the IKE Crypto Profile for the predefined template you want to use.
- Create a new IPSec Tunnel, specifying the new IKE gateway you created, but copying all the other settings from the default template.
- When you onboard the service connection or remote network connection, Enable Secondary WAN and specify the tunnel you created for the backup WAN.
- Create a new IKE Gateway for the backup tunnel, copying the settings from the predefined template you want to duplicate.
- Complete the configuration of the service connection or remote network connection by matching the cryptos, pre-shared key, and Peer identifiers on the device that is used to terminate the other side of the IPSec tunnel.
- (Optional) If you need to onboard multiple remote network
connections that use the same types of networking devices, Export the
configuration of the remote network, edit the settings, then Import that
configuration. See Onboard Multiple Remote Network Connections of the Same Type for details.
Onboard Multiple Remote Network Connections of the Same Type
To streamline the process to Configure the GlobalProtect Cloud Service for Remote Networks, you can onboard a single remote network connection that uses a networking device that is common to your network deployment, then Export those settings to a Comma Separated Value (CSV) text file. The CSV file includes the values of IPSec tunnel and IKE gateway settings for the network you selected for export. After you export the common configuration settings, you can edit these settings and make them unique for each new remote network you want to onboard, retain the settings that are common to each device, then Import that configuration.
For more information, including a description of all editable fields in the CSV table, see Onboard Remote Networks with Configuration Import.
Supported IKE and IPSec Cryptographic Profiles for Common SD-WAN Devices
This section provides you with the supported cryptographic profiles for many common SD-WAN devices. If you are configuring an SD-WAN device, use these profiles as a guideline as to what you can configure for the remote network in GlobalProtect cloud service.
Supported IKE and IPSec Cryptographic Profiles for Viptela SD-WAN Devices
The following table documents the IKE/IPSec crypto settings that are supported with the GlobalProtect cloud service and Viptela SD-WAN devices.
A check mark indicates that the profile or architecture type is supported; a dash (—) indicates that it is not supported. Default and Recommended settings are noted in the table.
|Crypto Profiles||GlobalProtect Cloud Service||Viptela SD-WAN|
|Tunnel Type||IPSec Tunnel|
|Dynamic Routing (BGP)||—|
|Dynamic Routing (OSPF)||—||—|
|IKE Versions||IKE v1|
|IPSec Phase 1 DH-Group||Group 1||—|
|IPSec Phase 1 Auth||MD5||—|
|IPSec Phase 1 Encryption||DES||—|
|IPSec Phase 1 Key Lifetime Default|
|IPSec Phase 1 Peer Authentication||Pre-Shared Key|
|IKE Peer Identification||FQDN|
|IKE Peer||As Static Peer|
|As Dynamic Peer||—|
|Ability to Negotiate Tunnel||Per Subnet Pair||—|
|Per Pair of Hosts||—|
|Per Gateway Pair|
|IPSec Phase 2 DH-Group||Group 1||—|
|IPSec Phase 2 Auth||MD5||—|
|IPSec Phase 2 Encryption||DES||—|
|IPSec Phase 2 Key Lifetime Default|
|Tunnel Monitoring Fallback||Dead Peer Detection (DPD)|
|Bidirectional Forwarding Detection (BFD)||—||—|
|SD-WAN Architecture Type||With Regional Hub/Gateway/Data Center||NA|
|No Regional Hub/Gateway/Data Center||NA|
Silver Peak SD-WAN Solution Guide
Silver Peak SD-WAN Solution Guide The following sections describe how you use Silver Peak EdgeConnect with the GlobalProtect cloud service to provide next-generation security on ...
Aryaka SD-WAN Solution Guide
Aryaka SD-WAN Solution Guide Aryaka and GlobalProtect cloud service seamlessly integrate to deliver a joint solution of a cloud-native global SD-WAN that includes private connectivity, ...
Citrix SD-WAN Solution Guide
Citrix SD-WAN Solution Guide The following sections describe how you use the Citrix SD-WAN with the GlobalProtect cloud service to provide next-generation security on internet-bound ...
Riverbed SteelConnect SD-WAN Solution Guide
Riverbed SteelConnect SD-WAN Solution Guide The following sections describe how you use Riverbed’s SD-WAN product, SteelConnect, with the GlobalProtect cloud service to provide next-generation security ...
Nuage Networks SD-WAN Solution Guide
Nuage Networks SD-WAN Solution Guide The following sections describe how you secure a Nuage Networks SD-WAN with GlobalProtect cloud service to provide next-generation security: Nuage ...
CloudGenix SD-WAN Solution Guide
CloudGenix SD-WAN Solution Guide The following sections describe how you use the CloudGenix SD-WAN with the GlobalProtect cloud service to provide next-generation security on internet-bound ...
Onboard a Google Cloud Platform VPC
Onboard an Google Cloud Platform VPC to the GlobalProtect cloud service and secure access to it for mobile users and remote networks. ...
Secure SD-WANs with GlobalProtect Cloud Service Overview
Secure SD-WANs with GlobalProtect Cloud Service Overview As organizations grow across different geographical locations, choosing a network becomes a delicate balancing act of cost, performance, ...
Configure the Citrix Remote Network
Configure the Citrix Remote Network To configure the Citrix SD-WAN remote network tunnel, use the following workflow. Before you start this workflow, perform the following ...