Configure the Aruba Remote Network
To configure the Aruba SD-WAN with Prisma
Access, complete the following workflow.
Validated IKE and IPSec Cryptographic Profiles
Both the Aruba Branch Gateways and Prisma Access support several options when it comes to setting up
VPN tunnels. The following table provides the configurations that
have been validated for this solution, and offer a good compromise
between performance, flexibility and security (considering the integration
is mostly for Internet-bound traffic).
Crypto Profile | Phase 1 | Phase 2 |
---|---|---|
Confidentiality | AES-256 You configure this setting as aes-256-cbc in
Prisma Access. | AES-256 You configure this setting as aes-256-cbc in
Prisma Access. |
Integrity | SHA256 | SHA1 |
Authentication | Username/Password | N/A |
Key Exchange Method | Diffie-Helman | Diffie-Helman |
Diffie-Helman Group | 14 | 14 |
NAT-Transversal | Enabled | N/A |
Dead Peer Detection (DPD) | Enabled | |
Perfect Forward Secrecy (PFS) | N/A | Yes |
VPN Type | N/A | Policy-based VPN |
Configure the Remote Network Connection in Prisma Access
You manage and configure Prisma Access using the same Panorama appliance that you use to manage
on-premise firewalls. To begin configuration of the remote network
connection, complete the following task.
- Create a new IPSec crypto profile in Panorama.The IKE and IPSec crypto profiles you create in these steps are common to all branches and you only need to create them once.
- Select.NetworkNetwork ProfilesIPSec Crypto
- Adda new IPSec crypto profile using the following recommended settings:
- Encryption:aes-256-cbc
- Authentication:sha1
- DH Group:group14
- Lifetime:2 Hours
- Create a new IKE crypto profile for the remote network tunnel.Be sure to use crypto values that are supported with Aruba and make a note of the values you use.
- Create a new IKE gateway in Panorama.
- Select.NetworkNetwork ProfilesIKE Gateways
- Adda new IKE gateway.Enter the following parameters:
- In theGeneraltab, leave theLocal IdentificationIP addressblank, because you do not know what this address is at the time of configuration. You can, however, enter in thePeer Identificaitonof a type ofFQDN (hostname)and enter the FQDN of the BGW.
- In theAdvanced Optionstab, enter the fields as shown in the following screenshot. Be sure to specify theIKE Crypto Profileyou created in Step 1
- Create an IPSec tunnel configuration.After you create the IKE gateway, you can apply it to the IPSec tunnel you create.
- Select.NetworkIPSec Tunnels
- Adda new IPSec tunnel.
- In theGeneraltab, specify theIKE GatewayandIPSec Crypto Profileyou created in earlier steps.
- Create a remote network connection in Panorama.Specify the following parameters:
- Choose aRegionthat is close to the remote network location that you want to onboard.
- Specify theIPSec Tunnelyou just created.
- If a backup gateway is in place in the branch, specify this backup gateway as a secondary by selectingEnable Secondary WANand selecting the tunnel between the secondary BGW andPrisma Access.
- Retrieve theService IP Addressof the Prisma Access side of the tunnel by selecting, clicking thePanoramaCloud ServicesStatusNetwork DetailsRemote Networksradio button, and copying the address in theService IP Addressfield.You need theService IP Addressto the IPSec tunnel for the Aruba SD-WAN.
Configure the Aruba BGW
The configuration required for the BGWs is
straightforward and can leverage Aruba Central’s group-based configuration
to reuse as much configuration as possible across branches.
- In the Aruba Branch Gateway, set up the tunnel to Prisma Access.
- Select.VPNCloud SecurityPalo Alto Networks - GPCS
- Enter values in the fields.
- Name—Enter an administrative name for the tunnel. The system will append_gpcsat the end.
- Priority—Enter a numeric identifier for the tunnel.
- Transform—Selectdefault-aes, which uses AES256 encryption with SHA1 Hash.
- Source FQDN—Enter the user ID created in Prisma Access (santaclara.branch in the following screenshot).
- Tunnel destination IP—Enter theService IP Addressfrom the remote network connection that you got when you configured the remote network connection in Prisma Access
- Uplink VLAN—Select the Uplink VLAN to be used to bring up tunnels to Prisma Access (in the case of BGWs) or the source VLAN in the case of VPNCs.
- IKE Shared Secret—Set the same value created in the Prisma Access configuration.
The solution is capable of setting up multiple tunnels and determining which traffic is sent through each one using PBR policies; therefore, you can configure active-active and active-backup redundancy.Even though the source FQDN has to be unique on a per-branch basis, you should configure the remaining parts of the tunnel configuration at the group level whenever possible. This hierarchical configuration model greatly streamlines configuration efforts. The following screenshot shows a specificSource FQDNconfigured for the local configuration and a genericSource FQDNspecified for the group-level configuration.
- Create one or more next-hop lists with the tunnels.After you create the the tunnels, next-hop lists group them together to be used inside PBR policies.
- Select.RoutingNextHop Configuration
- Create aNextHop.
- AddSite-to-SiteIPSec maps.
- Enter different priorities for the different tunnels.Prisma Access doesn’t support load-balancing.
- SelectPreemptive-failover.
- Add the next hop to a routing policy by selecting.RoutingPolicy-Based RoutingIn the following example, the policy is sending all the traffic to private subnets (an alias representing 10.0.0.0/8 and 172.16.0.0/12) through the regular path, and it’s sending the rest of the traffic through the Prisma Access nodes.
- Apply policies to the roles or VLANs.After you create the routing policy, the last step you perform is to apply it to the role or VLAN that you want to send through Prisma Access.If there is a conflict between PBR policies applied to a role and VLAN, policies applied to the role take precedence.The following screen shows a PBR policy being applied to a VLAN.The following screen shows a PBR policy being applied to a role.
- Continue to Verify and Troubleshoot the Aruba Remote Network to verify the status of the remote network tunnel.
Most Popular
Recommended For You
Recommended Videos
Recommended videos not found.