{"id":972,"date":"2022-01-15T05:43:00","date_gmt":"2022-01-15T13:43:00","guid":{"rendered":"https:\/\/tungle.ca\/?p=972"},"modified":"2022-05-31T14:55:29","modified_gmt":"2022-05-31T22:55:29","slug":"create-a-vpn-ipsec-site-to-site-between-palo-alto-and-cisco-router","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=972","title":{"rendered":"Create a VPN IPSEC site to site between Palo Alto and Cisco Router"},"content":{"rendered":"\n

This is a lab to set up a VPN site-to-site tunnel between both devices.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Configure interfaces and enable IPSEC VPN site to site on Cisco Router.<\/p>\n\n\n\n

R1(config)#int g0\/0\nR1(config-if)#ip add 192.168.20.1 255.255.255.0\nR1(config-if)#no shut\n\n\nR1(config)#int g1\/0\nR1(config-if)#des \"Connect to PA\"\"\nR1(config-if)#ip add 10.10.10.1 255.255.255.0\nR1(config-if)#no shut\n\nCreate an ACL for VPN.\nR1(config)#ip access-list extended ACL\nR1(config-ext-nacl)#permit ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255\n\n\nCreate ISAKMP phase 1 of the tunnel.\n\n\nR1(config)#crypto isakmp policy 1\nR1(config-isakmp)#encr aes\nR1(config-isakmp)#hash md5\nR1(config-isakmp)#authentication pre-share\nR1(config-isakmp)#group 5\nR1(config-isakmp)#lifetime 86400\n# Assign authentication-key for remote peer.\nR1(config)#crypto isakmp key cisco123 address 10.10.10.2\n\n\n# Create IPSEC transfrom set for phase 2\nR1(config)#crypto ipsec transform-set TSET esp-aes esp-sha-hmac\n\n# Create cryoto map to apply the phase 2 settings to the interface\ncrypto map PA1 10 ipsec-isakmp\nset peer 10.10.10.2\r\nset transform-set TSET\nmatch address ACL\n\n# Applly crypto map to an interface.\n\nR1(config-crypto-map)#int g1\/0\nR1(config-if)#crypto map PA1\n\n# Create a static route to route traffic between both sites.\nR1(config)#ip route 0.0.0.0 0.0.0.0 10.10.10.2\n<\/code><\/pre>\n\n\n\n
Access Palo Alto Web management.<\/p>\n\n\n\n
Assign an IP address for interface e1\/1 and e1\/2.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Create a new tunnel 1 on PA.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Configure a static route between PA and Cisco Router and set next hop is “None”.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Configure IKECrypto as on Cisco Router.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Configure IKE Gateway.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Configure IPSEC Tunnel.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Configure Proxy ID.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Create both Security policies to allow traffic from the Trusted zone to the VPN zone and vice versa.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
From Webterm2 (192.168.10.2) pings Webterm 3 (192.168.20.2).<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Check PA, the IPSEC tunnel is up.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
This is a lab to set up a VPN site-to-site tunnel between both devices. Configure interfaces and enable IPSEC VPN site to site on Cisco Router. Access Palo Alto Web management. Assign an IP address for interface e1\/1 and e1\/2. Create a new tunnel 1 on PA. Configure a static route between PA and Cisco […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,21,11],"tags":[15,18,13],"class_list":["post-972","post","type-post","status-publish","format-standard","hentry","category-cisco","category-palo-alto","category-security","tag-cisco","tag-palo-alto","tag-security"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/972","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=972"}],"version-history":[{"count":3,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/972\/revisions"}],"predecessor-version":[{"id":3893,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/972\/revisions\/3893"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=972"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=972"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=972"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}