Prisma Access
Integrate Prisma Access with Nuage SD-WAN
Table of Contents
Expand All
|
Collapse All
Prisma Access Docs
-
- Prisma Access China
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
-
-
-
- 5.2 Preferred and Innovation
- 5.1 Preferred and Innovation
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
Integrate Prisma Access with Nuage SD-WAN
Where Can I Use This? | What Do I Need? |
---|---|
|
|
You integrate Prisma Access with the Nuage networks SD-WAN by creating a remote network
connection as an IPSec tunnel between Prisma Access and the SD-WAN. You create matching
IKE crypto profiles, IPSec crypto profiles, and IKE gateway settings on each side of the IPSec
tunnel in the Nuage Networks SD-WAN and Prisma Access. For Prisma Access (Cloud
Management), ensure that you use supported IKE and IPSec cryptographic settings
detailed here. You set up these connections on the Nuage Networks side directly from the
customer premises equipment (CPE) to Prisma Access without the need of SD-WAN gateways
to perform WAN functionality. Nuage Networks’ solution differs from other SD-WAN vendors
in that it uses customer premises equipment (CPE) that enables more advanced
capabilities. These fully-functional CPEs can scale, set up a full mesh, and perform
direct internet breakout to internet directly. The Nuage Networks SD-WAN does not
require gateways or hubs to enable WAN functionality.
Integrate Prisma Access with Nuage SD-WAN (Strata Cloud Manager)
Strata Cloud Manager
)Complete the following task to configure the remote network connection as a
site-to-site IPSec tunnel.
- Follow the steps to Connect a remote network to Prisma Access.
- Enter aSite Nameand select aPrisma Access Locationthat is close to the remote network location that you want to onboard.
- Select theIPSec Termination Nodeto use for the remote network.
- Configure the primary tunnel.
- Set Upthe primary tunnel.When configuring the tunnel, use the validated settings.
- Specify a name for theIPSec Tunneland clickCreate New.
- Enter aTunnel Name.
- Set theBranch Device TypetoOther Devices.
- Set the Authentication type toPre-Shared Keyand then enterPre-Shared KeyandConfirm Pre-Shared Key.
- Specify how the peers will identify each other.
- Set theIKE Local IdentificationandIKE Peer IdentificationtoUser FQDN (email address).Make note of the value that you use for the Peer Identification and thePre-Shared keyyou use; you must match these settings for the Nuage Networks side of the connection in step 6 when you Set Up the Remote Network Tunnel in Nuage Networks.
- EnableIKE Passive Mode.
- In the Proxy ID section andAdda default route for all local and remote prefixes.Creating this route ensures that all prefixes in the VPN use this IPSec tunnel.
- SelectIPSec Advanced OptionsandCreate Newto create a new IPSec crypto profile for the remote network tunnel using the recommended settings.Make sure you use IPSec crypto settings that are supported with Prisma Access and Nuage Networks SD-WAN
- SelectIKE Advanced OptionsandCreate Newto create a new IKE cryptographic profile for the remote network tunnel.Make sure you enableIKE NAT Traversal. The Nuage Network Services Gateway (NSG) initiates the IKE negotiation, and allows the negotiation to occur even if Nuage Networks side is behind NAT. Refer to the IKE crypto settings that are supported with Nuage for the rest of the settings and make a note of the values you use.
- Savethe tunnel configuration.
- Push your configuration changes.
- Return toand selectManageService SetupRemote Networks.Push ConfigPush
- SelectRemote Networks.
- Pushyour changes.
- Find the IP address used on the Prisma Access side of the IPSec tunnel.
- Go toand make a note of theManageService SetupRemote NetworksService IPaddress.You use this IP address as the peer address when you set up the IPSec tunnel on the Meraki SD-WAN.
Set Up the Remote Network Tunnel in Nuage Networks
After you configure the remote network tunnel in Prisma Access, configure the
tunnel in Nuage Networks by completing the following task.
Note that Dead Peer Detection (DPD) is only configured in Nuage Networks. No DPD
configuration is required in Prisma Access because the NSG is the DPD initiator
and Prisma Access can only reply to requests.
- In your organization, create the Gateway using the Nuage Networks IKE gateway object.In theIP Addressfield, enter theService IP addressthat you retrieved after you completed the setup of the remote network tunnel in Prisma Access.
- Define the remote subnet for which traffic will be sent to the gateway.The IKE gateway connection uses the underlay breakout mechanism as shown in the following diagram:All traffic to Prisma Access is through the underlay. If you enable underlay, and if the remote subnet associated with Prisma Access matches the destination IP in the customer packet, then the Nuage Networks SD-WAN sends the packet to Prisma Access. If the destination IP does not match, the SD-WAN sends the packet to internet breakout using underlay breakout and port address translation (PAT) rules.
- Specify a default route to the gateway so that the network sends all internet traffic to Prisma Access.
- Create an IKE encryption profile.This profile must match the values that you specified in the Prisma Access IPSec configuration.
- Create an IKE gateway profile.
- Enter aNamefor the gateway profile.
- SelectCheck anti-replay.
- Select theService class.
- Select theGatewayandEncryption Profile, using the settings you created for Prisma Access.
The example in the following screenshot uses one pre-shared key per connection, which means that the IKE Gateway profile won't use a pre-shared key object, and theAuthentication Methodfield is empty. - Associate the remote network connection with the NSG uplink port.You associate the remote network connection with the Nuage Networks NSG at the uplink VLAN level. This association contains an NSG identifier in RFC 822 format and includes the pre-shared key that is used for the connection.
- Check the status of the tunnel connection by entering the following command.A status ofUPindicates that the connection is successful.A:vsc1# tools vswitch 86.229.176.112 command "nuage-nsg-ike-cli show tunnel-status-summary" ------------------------------------------------------------------------------- Gateway Name Local IP Remote IP Phase1 Phase2 ------------------------------------------------------------------------------- paloalto 192.168.0.103 3.121.193.101 up up -------------------------------------------------------------------------------
- Next steps: Learn how Nuage Networks monitors the remote network, and troubleshoot the Nuage Networks remote network connection to Prisma Access, if required.
Nuage Networks Dead Peer Detection and Internet Probing
To detect issues with an IKE gateway for the remote network connection, Nuage
Networks VNS uses the Dead Peer Detection (DPD) mechanism, in addition to using
a probing mechanism to probe internet services.
The probes are divided into two hierarchical levels: Tier1 and Tier2. Nuage
Networks initiates the probe. The Tier 1 probe tests the connectivity of the
remote network connection to Prisma Access and the Tier 2 probe tests the
connectivity to the internet.
![](/content/dam/techdocs/en_US/dita/_graphics/prisma-access/integration/nuage-tunnel-defense.png)
Each connection is composed of an Active IPSec tunnel (priority 100) and a backup
IPSec tunnel (priority 200). The HTTP probes run on both connections.
![](/content/dam/techdocs/en_US/dita/_graphics/prisma-access/integration/nuage-tunnel-active-and-backup.png)
- Tier 1 Probe—Each Tier1 probe is associated to a weight (between 1 and 100%). For Tier1 to fail, the sum of the Tier1 probes that fail must be equal to or greater than 100%. If the Tier1 probe goes down, Tier 2 probe monitoring also goes down.
- Tier 2 Probe—The Tier 2 probe uses round-robin monitoring across a set of internet FQDNs. Consecutive probe tests must fail for the Tier2 probe to fail.
Create an HTTP Probe Object
To create an HTTP probe object, complete the following task.
- In the Nuage Networks UI, selectPerformance Monitors.
- Create a performance monitor with the following values:
- Specify aHold Down Timervalue that defines how long the VSD waits for a response before it determines that the performance monitor is unsuccessful and switches to the backup tunnel. The default is 1000 ms.
- Specify aProbe TypeofHTTP.
After you clickCreate, the Nuage VNS creates two tiers: Tier 1 and Tier 2. There is no option to add or Remove tiers. - Create Tier 1 URLs, specifying the following values:
- Down Threshold Count—Defines the number of consecutive failed probes before the VSD declares a state change and raises an alarm.
- HTTP Request Type—Specifies the HTTP request method used for the HTTP ping.
- URL Weight—Defines the percent weight for the URL within Tier 1. The sum of the URL weights in Tier 1 cannot exceed 100.
- URL—Defines the HTTP or HTTPS target. Specify one URL up to 2000 characters long.
- Rate—Defines the rate at which the probe sends probe packets to the destination target.
- Timeout (ms)—Defines how long the VSD waits for a response before considering a probe unsuccessful.
- Edit Tier 2 options to change the interval and timeout values of the Tier 2 probe by specifying the following values:
- Interval (s)—Defines the rate at which the probe sends packets to the destination target.
- Probe Timeout (ms)—This parameter defines how long the VSD waits for a response before it determines a probe to be unsuccessful.
- Down Threshold Count—This parameter defines the number of consecutive failed probes before the VSD declares a state change and raises an alarm.
- Create Tier 2 URLs with the following values:
- HTTP Request Type—Specifies the HTTP request method that is used for the HTTP ping.
- URL—Defines the HTTP or HTTPS target. Specify one URL up to 2000 characters long.
- After you create the HTTP probe object with Tier 1 and Tier 2 information, associate the probe to the active and backup IPSec tunnel.The following condition must apply to associate a probe with an IKE gateway connection:
- The remote subnet associated with IKE gateway must be 0.0.0.0/0.
- You must associate all local subnets with the uplink IPSec connection.
If you do not meet the preceding conditions, tunnel association fails.
Troubleshoot the Remote Network
Prisma Access provides logs and widgets that provide you with the status of
remote tunnels and the status of each tunnel.
- Go toand check theManageService SetupRemote NetworksStatusof the tunnel.
- Go toand check theActivityLog ViewerCommon/Systemlogs for IPSec- and IKE-related messages.To view VPN-relates messages, set the filter tosub_type.value = vpn.The messageignoring unauthenticated notify payloadindicates that the route has not been added in the crypto map on the other side of the IPSec tunnel after the IPSec negotiation has already occurred.
- Check theFirewall/Trafficlogs and view the messages that are coming from the zone that has the same name as the remote network.In the logs, the remote network name is used as the source zone.
Integrate Prisma Access with Nuage SD-WAN (Panorama)
Panorama
)Complete the following task to configure the remote network connection as a
site-to-site IPSec tunnel.
- Make sure you have specified theTemplateofRemote_Network_Templatebefore starting this task.
- Give the profile a name and specify IKE settings.Make a note of these settings; you specify the same settings when you create the IPSec tunnel in the Nuage Networks SD-WAN.
- Specify a name for the profile and specify IPSec crypto parameters.Make a note of these parameters; you specify these same parameters when you configure the Nuage Networks side of the remote network tunnel in a later task.
- Specify aName,Version,Peer IP Address Type, andAuthentication, and specify aPeer Identificationthat will be synchronized with the Nuage Networks configuration.Make note of the of theUser FQDN (email address)that you use for thePeer Identificationand thePre-Shared keyyou use; you must match these settings for the Nuage Networks side of the connection in step 6 when you Set Up the Remote Network Tunnel in Nuage Networks.
- Click theAdvanced Optionstab and make sure thatEnable Passive ModeandEnable NAT Traversalare selected.The Nuage Network Services Gateway (NSG) initiates the IKE negotiation, and allows the negotiation to occur even if Nuage Networks side is behind NAT.
- Select theIKE GatewayandIPSec Crypto Profileyou created earlier in this task.
- Select theProxy IDstab and create a default route for all local and remote prefixes.Creating this route ensures that all prefixes in the VPN use this IPSec tunnel.
- Add a new remote network connection.
- SelectandPanoramaCloud ServicesConfigurationRemote NetworksAddthe connection.
- Enter aName, select theBandwidthandRegion, and select theIPSec Tunnelyou specified in a previous step, and specify a route to the Nuage Networks SD-WAN.You cannot change the name of this tunnel after you create it.This example specifies aStatic Routeto the Nuage Networks SD-WAN with an IP address of 10.61.0.0/16.
- Commit the configuration changes to Panorama and push the configuration out to Prisma Access for remote networks.
- Click.CommitCommit to Panorama
- Click. ClickCommitCommit and Push, and select both Prisma Access for remote networks and Prisma Access for service setup to push the configuration out to the service.Edit SelectionsPrisma Access
- ClickOK, then clickCommit and Push.Prisma Access displays a success page after the commit succeeds.
- Make a note of theService IP addressof the Prisma Access side of the tunnel. To find this address in Panorama, select, click thePanoramaCloud ServicesStatusNetwork DetailsRemote Networksradio button, and find the address in theService IP Addressfield.
Set Up the Remote Network Tunnel in Nuage Networks
After you configure the remote network tunnel in Prisma Access, configure the
tunnel in Nuage Networks by completing the following task.
Note that Dead Peer Detection (DPD) is only configured in Nuage Networks. No DPD
configuration is required in Prisma Access because the NSG is the DPD initiator
and Prisma Access can only reply to requests.
- In your organization, create the Gateway using the Nuage Networks IKE gateway object.In theIP Addressfield, enter theService IP addressthat you retrieved after you completed the setup of the remote network tunnel in Prisma Access.
- Define the remote subnet for which traffic will be sent to the gateway.The IKE gateway connection uses the underlay breakout mechanism as shown in the following diagram:All traffic to Prisma Access is through the underlay. If you enable underlay, and if the remote subnet associated with Prisma Access matches the destination IP in the customer packet, then the Nuage Networks SD-WAN sends the packet to Prisma Access. If the destination IP does not match, the SD-WAN sends the packet to internet breakout using underlay breakout and port address translation (PAT) rules.
- Specify a default route to the gateway so that the network sends all internet traffic to Prisma Access.
- Create an IKE encryption profile.This profile must match the values that you specified in the Prisma Access IPSec configuration.
- Create an IKE gateway profile.
- Enter aNamefor the gateway profile.
- SelectCheck anti-replay.
- Select theService class.
- Select theGatewayandEncryption Profile, using the settings you created for Prisma Access.
The example in the following screenshot uses one pre-shared key per connection, which means that the IKE Gateway profile won't use a pre-shared key object, and theAuthentication Methodfield is empty. - Associate the remote network connection with the NSG uplink port.You associate the remote network connection with the Nuage Networks NSG at the uplink VLAN level. This association contains an NSG identifier in RFC 822 format and includes the pre-shared key that is used for the connection.
- Check the status of the tunnel connection by entering the following command.A status ofUPindicates that the connection is successful.A:vsc1# tools vswitch 86.229.176.112 command "nuage-nsg-ike-cli show tunnel-status-summary" ------------------------------------------------------------------------------- Gateway Name Local IP Remote IP Phase1 Phase2 ------------------------------------------------------------------------------- paloalto 192.168.0.103 3.121.193.101 up up -------------------------------------------------------------------------------
- Next steps: Learn how Nuage Networks monitor the remote network, and troubleshoot the Nuage Networks remote network connection to Prisma Access, if required.
Nuage Networks Dead Peer Detection and Internet Probing
To detect issues with an IKE gateway for the remote network connection, Nuage
Networks VNS uses the Dead Peer Detection (DPD) mechanism, in addition to using
a probing mechanism to probe internet services.
The probes are divided into two hierarchical levels: Tier1 and Tier2. Nuage
Networks initiates the probe. The Tier 1 probe tests the connectivity of the
remote network connection to Prisma Access and the Tier 2 probe tests the
connectivity to the internet.
![](/content/dam/techdocs/en_US/dita/_graphics/prisma-access/integration/nuage-tunnel-defense.png)
Each connection is composed of an Active IPSec tunnel (priority 100) and a backup
IPSec tunnel (priority 200). The HTTP probes run on both connections.
![](/content/dam/techdocs/en_US/dita/_graphics/prisma-access/integration/nuage-tunnel-active-and-backup.png)
- Tier 1 Probe—Each Tier1 probe is associated to a weight (between 1 and 100%). For Tier1 to fail, the sum of the Tier1 probes that fail must be equal to or greater than 100%. If the Tier1 probe goes down, Tier 2 probe monitoring also goes down.
- Tier 2 Probe—The Tier 2 probe uses round-robin monitoring across a set of internet FQDNs. Consecutive probe tests must fail for the Tier2 probe to fail.
Create an HTTP Probe Object
To create an HTTP probe object, complete the following task.
- In the Nuage Networks UI, selectPerformance Monitors.
- Create a performance monitor with the following values:
- Specify aHold Down Timervalue that defines how long the VSD waits for a response before it determines that the performance monitor is unsuccessful and switches to the backup tunnel. The default is 1000 ms.
- Specify aProbe TypeofHTTP.
After you clickCreate, the Nuage VNS creates two tiers: Tier 1 and Tier 2. There is no option to add or Remove tiers. - Create Tier 1 URLs, specifying the following values:
- Down Threshold Count—Defines the number of consecutive failed probes before the VSD declares a state change and raises an alarm.
- HTTP Request Type—Specifies the HTTP request method used for the HTTP ping.
- URL Weight—Defines the percent weight for the URL within Tier 1. The sum of the URL weights in Tier 1 cannot exceed 100.
- URL—Defines the HTTP or HTTPS target. Specify one URL up to 2000 characters long.
- Rate—Defines the rate at which the probe sends probe packets to the destination target.
- Timeout (ms)—Defines how long the VSD waits for a response before considering a probe unsuccessful.
- Edit Tier 2 options to change the interval and timeout values of the Tier 2 probe by specifying the following values:
- Interval (s)—Defines the rate at which the probe sends packets to the destination target.
- Probe Timeout (ms)—This parameter defines how long the VSD waits for a response before it determines a probe to be unsuccessful.
- Down Threshold Count—This parameter defines the number of consecutive failed probes before the VSD declares a state change and raises an alarm.
- Create Tier 2 URLs with the following values:
- HTTP Request Type—Specifies the HTTP request method that is used for the HTTP ping.
- URL—Defines the HTTP or HTTPS target. Specify one URL up to 2000 characters long.
- After you create the HTTP probe object with Tier 1 and Tier 2 information, associate the probe to the active and backup IPSec tunnel.The following condition must apply to associate a probe with an IKE gateway connection:
- The remote subnet associated with IKE gateway must be 0.0.0.0/0.
- You must associate all local subnets with the uplink IPSec connection.
If you do not meet the preceding conditions, tunnel association fails.
Troubleshoot the Remote Network
Prisma Access provides logs that provide you with the status of remote tunnels
and the status of each tunnel. To view these logs in Panorama, select .
Monitor
Logs
System
To debug tunnel issues, you can filter for tunnel-specific logs by using the
object identifier corresponding to that tunnel. The following figures show
errors related to tunnel misconfiguration and negotiation issues.
![](/content/dam/techdocs/en_US/dita/_graphics/prisma-access/integration/silver-peak-troubleshoot-1.png)
![](/content/dam/techdocs/en_US/dita/_graphics/prisma-access/integration/silver-peak-troubleshoot-2-ike.png)
![](/content/dam/techdocs/en_US/dita/_graphics/prisma-access/integration/silver-peak-troubleshoot-3.png)
![](/content/dam/techdocs/en_US/dita/_graphics/prisma-access/integration/silver-peak-troubleshoot-4.png)
![](/content/dam/techdocs/en_US/dita/_graphics/prisma-access/integration/silver-peak-troubleshoot-5.png)
![](/content/dam/techdocs/en_US/dita/_graphics/prisma-access/integration/silver-peak-troubleshoot-6.png)