What are proxy IDs or traffic selectors, and why must the crypto ACLs mirror each other?
Show the answer
Say this first
Proxy IDs (IKEv1) or traffic selectors (IKEv2) are the local and remote networks, and optionally the protocol and ports, that a phase 2 SA protects. Each side proposes them from its own policy and the other side must accept them. If my ACL says 10.1.0.0/24 to 10.2.0.0/24, the peer's must say 10.2.0.0/24 to 10.1.0.0/24, a mirror image. A mismatch leaves phase 1 up and phase 2 failing.
Go deeper
Mirrored crypto ACLs
! R1 (HQ)
ip access-list extended VPN-TRAFFIC
permit ip 10.1.0.0 0.0.0.255 10.2.0.0 0.0.0.255
! R2 (branch)
ip access-list extended VPN-TRAFFIC
permit ip 10.2.0.0 0.0.0.255 10.1.0.0 0.0.0.255Rules
- Each permit line becomes its own SA pair.
- Avoid
permit ip any anyin a crypto map ACL: it tries to encrypt everything leaving the interface, including internet traffic. - A route-based peer proposes 0.0.0.0/0 to 0.0.0.0/0. A policy-based peer must be configured to match.
Names by vendor
| Platform | Term |
|---|---|
| Cisco IOS | crypto ACL, proxy identities |
| Palo Alto | Proxy ID on the IPsec tunnel |
| FortiOS | phase 2 selectors |
| Junos | proxy-identity or traffic-selector |
They will ask next
What does a deny line in a crypto ACL do?
It means "do not protect this traffic with this crypto map entry". The packet is not dropped: it is checked against later entries and otherwise sent in clear. To block traffic, use an interface ACL.
Palo Alto to a Cisco crypto map, phase 1 up, phase 2 fails. Most likely fix?
The Palo Alto tunnel is route-based and, without proxy IDs, proposes 0.0.0.0/0 both ways, which the Cisco crypto ACL rejects. Add proxy IDs on the Palo Alto tunnel that mirror each line of the Cisco ACL.
Traps
- Saying the ACLs must be identical. They must be mirror images, source and destination swapped.