Really need your help Need help in understanding an issue faced when creating a tunnel between Asa and Sonicwall (Issue got resolved) still need help to understand.

SonicWall: Phase 1
Encryption aes
Authentication sha265
Dh 14
Lifetime 86400

Asa: phase 1
Encryption aes
Integrity sha256
Dh 15
Prf sha
Lifetime 86400

As you can see my asa is by default configured with prf. The remote firewall sonicwall doesn't have prf on phase 1, but after changing my config of prf on asa from sha to sha256 the tunnel comes up.

Can anyone tell me if sonicwall is configured with default prf of sha256? Or else my integrity and prf should be same to match remote fw sonicwall authentication parameters As the phase 1 parameters should be same means prf is there on sonicwall otherwise the tunnel would never come up.

Optional: Palo alto also has the same authentication option so in that case also I need to keep my integrity and prf.

  • 1
    Authentication sha265, or did you mean Authentication sha256? You should really directly copy and paste from the devices to avoid typos and use the Preformatted-text option ({}). – Ron Maupin Jan 22 at 20:13
  • Sorry its sha 256. On both fw. – Sajesh Achari Jan 22 at 20:20
  • Actually im off shift but this tunnel making we wonder how prf changing bring up the tunnel. As other end engineer also shocked bcoz he is also never done prf config on sonicwall for phase1 ikev2 – Sajesh Achari Jan 22 at 20:21
  • With IPsec, you should never rely on defaults but configure all the parameters top to bottom. – Zac67 Jan 22 at 20:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.