Transcript
VPN Features
® PAN-OS New
Features Guide Version 7.1
Copyright © 2007-2015 Palo Alto Networks
Contact Information Corporate Headquarters:
Palo Alto Networks 4401 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com/company/contact-us
About this Guide This guide describes how to use the new features introduced in PAN-OS 7.1. For additional information, refer to the following resources:
For information on the additional capabilities and for instructions on configuring the features on the firewall, refer to https://www.paloaltonetworks.com/documentation.
For access to the knowledge base and community forums, refer to https://live.paloaltonetworks.com.
For contacting support, for information on support programs, to manage your account or devices, or to open a support case, refer to https://www.paloaltonetworks.com/support/tabs/overview.html.
For the most current PAN-OS and Panorama 7.1 release notes, go to https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os-release-notes.html.
To provide feedback on the documentation, please write to us at:
[email protected].
Palo Alto Networks, Inc. www.paloaltonetworks.com © 2016 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at http://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies. Revision Date: April 21, 2016
2 • PAN-OS 7.1 New Features Guide
© Palo Alto Networks, Inc.
Copyright © 2007-2015 Palo Alto Networks
VPN Features
DES Support for Crypto Profiles
© Palo Alto Networks, Inc.
PAN-OS 7.1 New Features Guide • 119
Copyright © 2007-2015 Palo Alto Networks
VPN Features
DES Support for Crypto Profiles To provide backward compatibility with legacy devices that do not use stronger encryption methods, IKE gateways and IPSec tunnels on the firewall now support Data Encryption Standard (DES) as an encryption algorithm in crypto profiles for site-to-site VPN connections. During tunnel negotiation, the firewall negotiates with the peer at the opposite end of the tunnel and uses the first encryption algorithm that both peers support based on the encryption list each peer has in its profile. Palo Alto Networks does not recommend DES encryption; instead, we recommend using a stronger encryption algorithm, such as 3DES or Advanced Encryption Standard (AES) if the peer can support it. You should list the algorithms from strongest to weakest so that the firewall matches the strongest possible encryption algorithm first.
Configure DES only if the legacy devices in your network cannot support a stronger encryption type. Configure DES for an IKE Gateway and IPSec Tunnel Profile for Site-to-Site VPN • Configure DES for an IKE gateway.
1.
Select Network > Network Profiles > IKE Crypto and select a crypto profile.
2.
For Encryption, Add the des encryption option from the drop-down. After an upgrade to PAN-OS 7.1, both the DHE and ECDHE options are selected by default. (Not recommended) Move Up the des encryption type to the top of the list only if you want the firewall to negotiate DES over other, stronger encryption algorithms.
3.
Click OK.
4.
See Define Cryptographic Profiles to configure the remainder of the profile.
5.
See Step 7 of Set Up an IKE Gateway to apply the profile to an IKE gateway.
120 • PAN-OS 7.1 New Features Guide
© Palo Alto Networks, Inc.
Copyright © 2007-2015 Palo Alto Networks
VPN Features
Configure DES for an IKE Gateway and IPSec Tunnel Profile for Site-to-Site VPN (Continued) • Configure DES for an IPSec tunnel.
Perform one of the following tasks, depending on whether you want to configure DES using an IPSec tunnel profile or using a manual key: Configure DES Using an IPSec Tunnel Profile 1.
Select Network > Network Profiles > IPSec Crypto and select a crypto profile.
2.
For Encryption, Add the des encryption option from the drop-down. If there are other encryption types in the profile, select des and Move Up the selection to the top of the list. (Not recommended) Move Up the des type to the top of the list only if you want the firewall to negotiate DES over other, stronger encryption algorithms.
3.
Click OK.
4.
See Define IPSec Crypto Profiles to configure the remainder of the profile.
5.
See Step 4 in Set Up an IPSec Tunnel to apply the profile to an IPSec tunnel. Configure DES Using a Manual Key 1.
• Save the configuration.
Select Network > IPSec Tunnels and select a tunnel.
2.
On the General tab, select Manual Key.
3.
For Encryption, select des.
4.
Click OK.
Click Commit.
© Palo Alto Networks, Inc.
PAN-OS 7.1 New Features Guide • 121
Copyright © 2007-2015 Palo Alto Networks
VPN Features
122 • PAN-OS 7.1 New Features Guide
© Palo Alto Networks, Inc.
Copyright © 2007-2015 Palo Alto Networks
