>
    Integrate Prisma Access with Aruba SD-WAN (Panorama)
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access
    3. Integrate Third-Party SD-WANs with Prisma Access
    4. Aruba SD-WAN Solution Guide
    5. Integrate Prisma Access with Aruba SD-WAN
    6. Integrate Prisma Access with Aruba SD-WAN (Panorama)
    Download PDF
    Prisma Access

    Integrate Prisma Access with Aruba SD-WAN (Panorama)

    Table of Contents

    Integrate Prisma Access with Aruba SD-WAN (Panorama)

    You manage and configure Prisma Access using the same Panorama appliance that you use to manage on-premises firewalls. To configure the remote network connection, complete the following task.
    1. Create a new IPSec crypto profile in Panorama.
      The IKE and IPSec Crypto profiles you create in these steps are common to all branches and you only need to create them once.
      1. Select NetworkNetwork ProfilesIPSec Crypto.
      2. Add a new IPSec Crypto profile using the following recommended settings:
        • Encryption: aes-256-cbc
        • Authentication: sha1
        • DH Group: group14
        • Lifetime: 2 Hours
    2. Create a new IKE crypto profile for the remote network tunnel.
      Be sure to use crypto values that are supported with Aruba and make a note of the values you use.
    3. Create a new IKE gateway in Panorama.
      1. Select NetworkNetwork ProfilesIKE Gateways.
      2. Add a new IKE gateway.
        Enter the following parameters:
        • In the General tab, leave the Local Identification IP address blank, because you don't know what this address is at the time of configuration. You can, however, enter in the Peer Identificaiton of a type of FQDN (hostname) and enter the FQDN of the BGW.
        • In the Advanced Options tab, enter the fields as shown in the following screenshot. Be sure to specify the IKE Crypto Profile you created in step 1
    4. Create an IPSec tunnel configuration.
      After you create the IKE gateway, you can apply it to the IPSec tunnel you create.
      1. Select NetworkIPSec Tunnels.
      2. Add a new IPSec tunnel.
      3. In the General tab, specify the IKE Gateway and IPSec Crypto Profile you created in earlier steps.
    5. Create a remote network connection in Panorama.
      Specify the following parameters:
      • Choose a Region that is close to the remote network location that you want to onboard.
      • Specify the IPSec Tunnel you created.
      • If a secondary gateway is in place in the branch, specify this secondary gateway as a secondary by selecting Enable Secondary WAN and selecting the tunnel between the secondary BGW andPrisma Access.
    6. Retrieve the Service IP Address of the Prisma Access side of the tunnel by selecting PanoramaCloud ServicesStatusNetwork Details, clicking the Remote Networks radio button, and copying the address in the Service IP Address field.
      You need the Service IP Address to the IPSec tunnel for the Aruba SD-WAN.

    Configure the Aruba BGW

    The configuration required for the BGWs is straightforward and can apply Aruba Central’s group-based configuration to reuse as much configuration as possible across branches.
    1. In the Aruba Branch Gateway, set up the tunnel to Prisma Access.
      1. Select VPNCloud SecurityPalo Alto Networks - GPCS.
      2. Enter values in the fields.
        • Name—Enter an administrative name for the tunnel. The system will append _gpcs at the end.
        • Priority—Enter a numeric identifier for the tunnel.
        • Transform—Select default-aes, which uses AES256 encryption with SHA1 Hash.
        • Source FQDN—Enter the User-ID created in Prisma Access (santaclara.branch in the following screenshot).
        • Tunnel destination IP—Enter the Service IP Address from the remote network connection that you got when you configured the remote network connection in Prisma Access
        • Uplink VLAN—Select the Uplink VLAN to be used to bring up tunnels to Prisma Access (in the case of BGWs) or the source VLAN in the case of VPNCs.
        • IKE Shared Secret—Set the same value created in the Prisma Access configuration.
        The solution can set up multiple tunnels and determine which traffic is sent through each one using PBR policy rules; therefore, you can configure active/active and active-backup redundancy.
        Even though the source FQDN has to be unique on a per-branch basis, you should configure the remaining parts of the tunnel configuration at the group level whenever possible. This hierarchical configuration model greatly streamlines configuration efforts. The following screenshot shows a specific Source FQDN configured for the local configuration and a generic Source FQDN specified for the group-level configuration.
    2. Create one or more next-hop lists with the tunnels.
      After you create the tunnels, next-hop lists group them together to be used inside PBR policy rules.
      1. Select RoutingNextHop Configuration.
      2. Create a NextHop.
      3. Add Site-to-Site IPSec maps.
      4. Enter different priorities for the different tunnels.
        Prisma Access does not support load-balancing.
      5. Select Preemptive-failover.
    3. Add the next hop to a routing policy by selecting RoutingPolicy-Based Routing.
      In the following example, the policy is sending all the traffic to private subnets (an alias representing 10.0.0.0/8 and 172.16.0.0/12) through the regular path, and it’s sending the rest of the traffic through the Prisma Access nodes.
    4. Apply policy rules to the roles or VLANs.
      After you create the routing policy, the last step you perform is to apply it to the role or VLAN that you want to send through Prisma Access.
      If there is a conflict between PBR policy rules applied to a role and VLAN, policy rules applied to the role take precedence.
      The following screen shows a PBR policy being applied to a VLAN.
      The following screen shows a PBR policy being applied to a role.
    5. Continue to verify the status and troubleshoot the remote network tunnel.

    Verify the Aruba Remote Network

    To verify the status of the remote network tunnel, perform one or more of the following steps.
    • Check the state of the tunnel from the interface of Aruba Central from the gateway monitoring page, in the tunnels section:
    • Check the state of the tunnel from Prisma Access by selecting PanoramaCloud ServicesStatusMonitorRemote Networks.
    • Use CLI from the BGWs, either through SSH or through the remote console provided in Aruba central.
    • You can also use CLI to verify if the user is in the correct role.

    Troubleshoot the Aruba Remote Network

    Prisma Access provides logs that provide you with the status of remote tunnels and the status of each tunnel. To view these logs in Panorama, select MonitorLogsSystem.
    To debug tunnel issues, you can filter for tunnel-specific logs by using the object identifier corresponding to that tunnel. The following figures show errors related to tunnel misconfiguration and negotiation issues.

    © 2024 Palo Alto Networks, Inc. All rights reserved.