Create an IPsec Profile
Table of Contents
Expand all | Collapse all
-
-
- Configure Circuits
- Configure Circuit Categories
- Configure Device Initiated Connections for Circuits
- Add Public IP LAN Address to Enterprise Prefixes
- Add a Branch
- Add a Data Center
- Manage Data Center Clusters
- Configure a Site Prefix
- Configure a DHCP Server
- Configure NTP for Prisma SD-WAN
- Enable IoT Device Visibility in Prisma SD-WAN
- Configure the ION Device at a Branch Site
- Configure the ION Device at a Data Center
- Switch a Site to Control Mode
- Allow IP Addresses in Firewall Configuration
-
- Configure a Controller Port
- Configure Internet Ports
- Configure WAN/LAN Ports
- Configure a Sub-Interface
- Configure a Loopback Interface
- Configure a PPPoE Interface
- Configure a Layer 3 LAN Interface
- Configure Application Reachability Probes
- Configure a Secondary IP Address
- Configure a Static ARP
- Configure a DHCP Relay
- Configure IP Directed Broadcast
-
-
- Configure IPFIX
- Configure IPFIX Profiles
- Configure IPFIX Templates
- Configure Collector Contexts
- Configure Filter Contexts
- Configure Global IPFIX Prefixes
- Configure Local IPFIX Prefixes
- Attach an IPFIX Profile to an ION Device
- Attach a Collector Context to a Device Interface
- Attach a Filter Context to a Device Interface
- Configure High Availability (HA) for IPFIX
- Flow Information Elements
- Options Information Elements
- Configure SNMP
-
-
-
- Prisma SD-WAN Branch Routing
- Prisma SD-WAN Data Center Routing
-
- Configure Multicast
- Create a WAN Multicast Configuration Profile
- Assign WAN Multicast Configuration Profiles to Branch Sites
- Configure a Multicast Source at a Branch Site
- Configure Global Multicast Parameters
- Configure a Multicast Static Rendezvous Point (RP)
- Learn Rendezvous Points (RPs) Dynamically
- View LAN Statistics for Multicast
- View WAN Statistics for Multicast
- View IGMP Membership
- View the Multicast Route Table
- View Multicast Flow Statistics
- Prisma SD-WAN Incident Policies
-
- Prisma SD-WAN Branch HA Key Concepts
- Configure Branch HA
- Configure HA Groups
- Add ION Devices to HA Groups
- View Device Configuration of HA Groups
- Edit HA Groups and Group Membership
-
- Configure Branch HA with Gen-1 Platforms (2000, 3000, 7000, and 9000)
- Configure Branch HA with Gen-2 Platforms (3200, 5200, and 9200)
- Configure Branch HA with Gen-2 Embedded Switch Platforms (1200-S or 3200-L2)
- Configure Branch HA for Devices with Software Cellular Bypass (1200-S-C-5G)
- Configure Branch HA for Platforms without Bypass Pairs
-
-
- Native SASE Integration with Prisma SD-WAN
- Connect a Single Prisma SD-WAN Site to Prisma Access
- Connect Multiple Prisma SD-WAN Sites to Prisma Access
- Edit Application Policy Network Rules
- Understand Service and Data Center Groups
- Verify Standard VPN Endpoints
- Configure Standard Groups
- Assign Domains to Sites
- Prisma SD-WAN Incidents and Alerts
Create an IPsec Profile
Let us learn to create an IPsec profile.
To create and configure an IPsec VPN connection
between a branch device and a cloud security service endpoint, you
must configure both endpoints with the same crypto settings. Since
crypto settings required to connect to the cloud security service
are likely to be the same across all ION devices, an IPsec profile
can be configured once and reused across all ION devices.
Before
you configure the IPsec profile on
Prisma SD-WAN
, make sure you
have the IPsec protocols and authentication details required to
connect to the cloud security service endpoint or consult your cloud
security service provider’s documentation for relevant details.- Selectand then selectManageResourcesConfiguration ProfilesIPsec.
- To add a new IPsec Profile, clickAdd IPsec Profile.If there are previously created IPsec profiles, these will display.
- On theInfoscreen, enter a name for the IPsec Profile andenter a description and tags.(optional)
- ClickNextand proceed to define the IKE Group.
- For theKey Exchangefield, selectIKEv1orIKEv2.
- Enter a life time for the IKE Group from theLifetimedrop-down if required.The default lifetime of an IKE Group is 24 hours. The tunnel will have to be re-established after the life time expires.
- Enter the port number of the communication port in the Port field.The default port is 500. The port number configured in the IKE group has to be the same as the port number configured in the standard VPN endpoint IKE group.
- Select the mode of operation from the Mode drop-down.The mode for IKEv1 can be Main or Aggressive. Choose the aggressive mode if the source interface or endpoint is behind NAT or there are multiple tunnels to the same remote endpoint.The mode for IKEv2 is ReAuth. If selected, then a new tunnel has to be re-negotiated when the lifetime is reached.
- On theProposalsscreen, select aDH Group,EncryptionandHash.Proposals is a list of crypto parameters to be used to secure the IKE and ESP sessions between the ION device and the endpoint.The set of parameters selected in theProposalsscreen have to be identical to the set of parameters selected for the standard VPN endpoint. You can add a proposal by clickingAdd Proposal. Up to 8 proposals can be added. While establishing the IPsec tunnel, the system checks for a proposal match with the standard VPN endpoint.
- Select if Dead Peer Detection (DPD) is to be enabled from theDPDtab.If enabled, enter the DPD delay and DPD timeout in seconds for IKEv1. If DPD fails within the configured timeout period, a new tunnel is attempted. For IKEv2, there is no DPD timeout; instead a series of 5 retransmissions is used.
- ClickNextand proceed to define theESP Group.
- Enter a life time for the ESP Group from the Lifetime drop-down if required.The default lifetime of an ESP Group is 24 hours.
- Choose the type of encapsulation from the Encapsulation drop-down.You can choose Auto or Force UDP. The type of encapsulation selected has to match the encapsulation configured at the standard VPN endpoint.
- Configure parameters in theProposaltab, and then clickNext.
- On theAuthenticationscreen, select the authentication type as eitherPSKorCertificatesfrom theTypedrop-down.
- For PSK authentication:
- Enter a secret in theSecretfield.This field is mandatory.
- For the Local ID Type, choose between Interface IP Address, Hostname or Custom.
- Enter an optional ID for the standard VPN endpoint in theRemote IDfield.
- For Certificate authentication:
- For theCertificatefield, upload the certificate by clickingImport File.
- Similarly upload a CA certificate in theLocal CA Certificatefield and a private key file in thePrivate Keyfield.
- (Optional)You can choose to upload the standard VPN endpoint CA certificate in theRemote CA Certificatefield.
- ClickNextto proceed to theSummaryscreen.
- Review the parameters selected and clickSave and Exit.All new customer tenants should have the default IPsec profiles allocated which match the best practices of some of our cloud partners. These default profiles can be copied and manipulated to meet the needs specific to standard VPN services. If these default profiles are not present on your tenant, open a support case to have them allocated.