1

Really need your help Need help in understanding an issue faced when creating a tunnel between Asa and Sonicwall (Issue got resolved) still need help to understand.

SonicWall: Phase 1
Ikev2
Encryption aes
Authentication sha256
Dh 14
Lifetime 86400

Asa: phase 1
Ikev2
Encryption aes
Integrity sha256
Dh 15
Prf sha
Lifetime 86400

As you can see my asa is by default configured with prf. The remote firewall sonicwall doesn't have prf on phase 1, but after changing my config of prf on asa from sha to sha256 the tunnel comes up.

Can anyone tell me if sonicwall is configured with default prf of sha256? Or else my integrity and prf should be same to match remote fw sonicwall authentication parameters As the phase 1 parameters should be same means prf is there on sonicwall otherwise the tunnel would never come up.

Optional: Palo alto also has the same authentication option so in that case also I need to keep my integrity and prf.

Improve this question
6
  • 1
    Authentication sha265, or did you mean Authentication sha256? You should really directly copy and paste from the devices to avoid typos and use the Preformatted-text option ({}).
    – Ron Maupin ♦
    Commented Jan 22, 2021 at 20:13
  • Sorry its sha 256. On both fw.
    – Sajesh Achari
    Commented Jan 22, 2021 at 20:20
  • Actually im off shift but this tunnel making we wonder how prf changing bring up the tunnel. As other end engineer also shocked bcoz he is also never done prf config on sonicwall for phase1 ikev2
    – Sajesh Achari
    Commented Jan 22, 2021 at 20:21
  • With IPsec, you should never rely on defaults but configure all the parameters top to bottom.
    – Zac67 ♦
    Commented Jan 22, 2021 at 20:43
  • Another issue that I don't see mentioned, which is relevant to Palo Alto <> ASA is defining proxy IDs on the Palo Alto side. We build tunnels between our Palo Alto devices and ASA devices on a fairly regular basis and I recall this being a sticking point when we first started doing it. Network > Ipsec tunnels > "tunnel name" > proxy ID tab. Secondly it looks like your phase 1 settings didn't match.
    – Ty Smith
    Commented Jun 2, 2021 at 3:24

2 Answers 2

Reset to default
1

VPN Wizard

These are the default settings that appear when you go through setting up a site to site via VPN Wizard.

VPN Manual

These are the default settings that appear when you go through setting up a site to site VPN Manually.

Improve this answer
0

When I used to configure IPsec VPN with ASA I usually had the PRF set to the same value as integrity (or authentication), because most other software used this setting and often it couldn't be changed.

If you're in doubt, you can capture the IKE_SA_INIT exchange and analyze it with wireshark (this is not encrypted). You'll find the values that are used by the peer in the transform substructure of the IKE proposals.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.