Configure IKEv2 Traffic Selectors
Focus
Focus
Network Security

Configure IKEv2 Traffic Selectors

Table of Contents

Configure IKEv2 Traffic Selectors

Where Can I Use This?What Do I Need?
  • PAN-OS
No license required
In IKEv1, a firewall that has a route-based VPN needs to use a local and remote Proxy ID in order to set up an IPSec tunnel. Each peer compares its proxy IDs with what it received in the packet to negotiate IKE Phase 2 successfully. IKE Phase 2 is about negotiating the SAs to set up an IPSec tunnel. (For more information on Proxy IDs, see Tunnel Interface.)
In IKEv2, you can configure traffic selectors, which are components of network traffic that are used during IKE negotiation. Traffic selectors are used during the CHILD_SA (tunnel creation) Phase 2 to set up the tunnel and to determine what traffic is allowed through the tunnel. The two IKE gateway peers must negotiate and agree on their traffic selectors; otherwise, one side narrows its address range to reach agreement. One IKE connection can have multiple tunnels; for example, you can assign different tunnels to each department to isolate their traffic. Separation of traffic also allows features such as QoS to be implemented.
The IPv4 and IPv6 traffic selectors are:
  • Source IP address—A network prefix, address range, specific host, or wildcard.
  • Destination IP address—A network prefix, address range, specific host, or wildcard.
  • Protocol—A transport protocol, such as TCP or UDP.
  • Source port—The port where the packet originated.
  • Destination port—The port the packet is destined for.
During IKE negotiation, there can be multiple traffic selectors for different networks and protocols. For example, the Initiator might indicate that it wants to send TCP packets from 172.168.0.0/16 through the tunnel to its peer, destined for 198.5.0.0/16. It also wants to send UDP packets from 172.17.0.0/16 through the same tunnel to the same gateway, destined for 0.0.0.0 (any network). The peer gateway must agree to these traffic selectors so that it knows what to expect.
It’s possible that one gateway will start negotiation using a traffic selector that is a more specific IP address than the IP address of the other gateway.
  • For example, gateway A offers a source IP address of 172.16.0.0/16 and a destination IP address of 192.16.0.0/16. But gateway B is configured with 0.0.0.0 (any source) as the source IP address and 0.0.0.0 (any destination) as the destination IP address. Therefore, gateway B narrows down its source IP address to 192.16.0.0/16 and its destination address to 172.16.0.0/16. Thus, the narrowing down accommodates the addresses of gateway A and the traffic selectors of the two gateways are in agreement.
  • If gateway B (configured with source IP address 0.0.0.0) is the Initiator instead of the Responder, gateway A will respond with its more specific IP addresses, and gateway B will narrow down its addresses to reach agreement.
Use the following workflow to configure traffic selectors.
  1. Select NetworkIPSec TunnelsProxy IDs.
  2. Select the IPv4 or IPv6 tab.
  3. Click Add and enter the Name in the Proxy ID field.
  4. In the Local field, enter the Source IP Address.
  5. In the Remote field, enter the Destination IP Address.
  6. In the Protocol field, select the transport protocol (TCP or UDP).
  7. Click OK.