The purpose of this article is to demonstrate how to configure an IPSec VPN using IKEv2 with pre-shared keys between a Cisco ASA and Palo Alto Firewall. This article includes a detailed video and step by step instructions on how to accomplish this.
Palo Alto Firewall 8.1
Configure Address Objects
Objects>Addresses>Add
Configure Tunnel Interface
Network>Interface>Tunnel tab>add
Configure Routing
Network>Virtual Routers>default>Add
Configure Security Policy
Policies>Security>add
Cisco ASA Firewall 9.9(1)
Configure interesting traffic ACL
access-list VPN-PALO-1 extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
Configure IKEv2 Policy
crypto ikev2 policy 1
encryption aes-256
integrity sha256
group 20
prf sha256
lifetime seconds 28800
Configure IPSec Proposal
crypto ipsec ikev2 ipsec-proposal VPN-IPSEC_PROPOSAL-1
protocol esp encryption aes-256
protocol esp integrity sha-256
Configure Crypto Map
crypto map VPN-OUTSIDE_CRYPTO_MAP-1 10 match address VPN-PALO-1
crypto map VPN-OUTSIDE_CRYPTO_MAP-1 10 set peer 3.3.3.3
crypto map VPN-OUTSIDE_CRYPTO_MAP-1 10 set ikev2 ipsec-proposal VPN-IPSEC_PROPOSAL-1
crypto map VPN-OUTSIDE_CRYPTO_MAP-1 10 set security-association lifetime seconds 28800
crypto map VPN-OUTSIDE_CRYPTO_MAP-1 interface OUTSIDE
Configure Group Policy
group-policy 3.3.3.3 internal
group-policy 3.3.3.3 attributes
vpn-tunnel-protocol ikev2
Configure Tunnel Group
tunnel-group 3.3.3.3 type ipsec-l2l
tunnel-group 3.3.3.3 general-attributes
default-group-policy 3.3.3.3
tunnel-group 3.3.3.3 ipsec-attributes
ikev2 remote-authentication pre-shared-key key123
ikev2 local-authentication pre-shared-key key123