Palo Alto side:

1. create a tunnel interface:

Network Tab > Interfaces > Tunnels
new tunnel: name it, assign it to a Virtual Router(cisco parlance: VRF) and Security Zone

2. create IKE phase 1: (cisco calls it isakemp)

Network > Network Profiles > IKE Crypto
create a new profile, name it: assign a DH Group, authentication, encryption and lifetime (DH group 2, sha1, aes128, 1 day)

3. create IKE phase 2: (cisco: “transform set”)

Network > Network Profiles > IPSec Crypto
Create a new profile
DH group (pfs/no-pfs)
encryption
authentication

4. specify peer:

Network > Network Profiles > IKE Gateway
name it, interface, peer type, peer IP, pre-shared key, exchange mode, define which IKE Crypto profile (phase2)

5. Add an IPSec Tunnel:

Network > IPSec Tunnels

General Tab:
Add tunnel, name it, choose which tunnel interface to use
Autokey (since they’re defined in your gateway/phase1/phase2
Choose gateway
choose IPSec Crypto Profile (phase2)

Proxy ID tab:
add the IP address/network

Cisco router side:

1. Configure Phase-1 (“isakmp”)

# conf t
(config)# crypto isakmp policy 1
(config-isakmp)# authentication pre-share
(config-isakmp)# encrypt aes128
(config-isakmp)# hash sha1
(config-isakmp)# group 2
(config-isakmp)# lifetime 86400
(config-isakmp)# exit
(config)# crypto isamp key <<key>> address <<peer address>>

Change <<key>> to your preshared key and <<peer address>> to the other system’s IP address (e.g. the public address on the interface of the palo alto FW)

NB: note that ISAKMP Phase 1 policy is defined globally. So if you have five different remote sites and configured five different ISAKMP Phase 1 policies (one for each remote router), when our router tries to negotiate a VPN tunnel with each site it will send all five policies and use the first match that is accepted by both ends.

2. configure phase-2 (“transform-set”, ACLs, crypto map)

2a. set an ACL to match the traffic that will be encrypted in the tunnel:

The format is:
(access-list ### permit ip <<source-network>> <<source-netmask>> <<destination-network>> <<destination-netmask>>)
example:

(config)# access-list 100 permit ip 10.0.0.0 0.255.255.255 192.168.1.0 0.0.0.255

NB: If you’re NAT’ing outbound traffic, you need to disable NAT for the traffic that you want encrypted through the tunnel; deny via ACL, like so:

(config)# ip nat inside source list 100 interface fastethernet0/2 overload
(config)# access-list 100 deny ip 10.0.0.0 0.255.255.255 192.168.1.0 0.0.0.255
(config)# access-list 100 permit ip 10.0.0.0 0.255.255.255 any

The deny applies specifically to traffic from 10./8 to 192.168.1./24 and then permits 10./8 going anywhere else.

2b. set the transform set (aka phase 2)

(config)# crypto ipsec transform-set IPSECSET esp-sha-hmac esp-aes
(cfg-crypto-trans)# exit

2c. set the crypto map to tie the elements together:

(config)# crypto map IPSECMAP 1 ipsec-isakmp
(config-crypto-map)# set transform-set IPSECSET
(config-crypto-map)# set peer <<peer address>>
(config-crypto-map)# match address 100
(config-crypto-map)# exit

3. Apply the crypto map to your outbound interface:

(config)# interface FastEthernet0/2
(if-config)# crypto map IPSECMAP

And you’re done.

useful commands:

show crypto isakmp policy
show crypto isakmp
show crypto isakmp detail
show crypto ipsec transform-set — shows you phase 2
show crypto map — shows complete crypto map
show crypto ipsec sa — shows how many packets encrypted/decryted/going through the tunnel

First, define your objects:

set security zones security-zone Internal address-book address TSserver1 192.168.1.151/32

and whatever service you need to:

set applications application MS-RDP protocol tcp destination-port 3389

and your destination nat pool:

set security nat destination pool dnat-192_168_1_151 address 192.168.1.151/32

set security nat destination pool dnat-192_168_1_151 address port 3389

and your NAT policy:

Define the NAT policy is configured which specifies the NAT pool that the traffic should be translated to.

set security nat destination rule-set dst-nat from zone Internet

set security nat destination rule-set dst-nat rule rule1 match destination-address 256.1.1.1/32

set security nat destination rule-set dst-nat rule rule1 match destination-port 63389

set security nat destination rule-set dst-nat rule rule1 then destination-nat pool dnat-192_168_1_151

and lastly, your security policy to allow the traffic through:

Use the internal (real) IP address and port of the server — the security/firewall aspect happens after the “networking” aspect of the connection:

set security policies from-zone untrust to-zone trust policy Internet_to_Internal_RDP match source-address any destination-address TSserver1 application MS-RDP
set security policies from-zone untrust to-zone trust policy Internet_to_Internal_RDP then permit

Once you’ve commited the change, an RDP connection to 256.1.1.1:63389 will get translated to 192.168.1.151:3389.

Juniper SRX: selectively disable TCP SYN or Sequence checking | Bart Jansens.

Quite a bit of useful stuff on this netsec guy’s blog, worth your time if you’re poking at junos devices.

On the AD side:

1. Install NPS on your AD DC.
2. Create a key (http://dice.neko-san.net/2012/08/linking-junos-authentication-to-active-directory-using-radius/ has screenshots, if you need that sort of thing.)
3. add clients (your switches/firewalls)

See also http://blog.arwin.me/os/cisco/how-to-setup-cisco-ios-to-authenticate-via-active-directory/

On a Cisco ASA:

aaa-server RADIUS protocol radius
aaa-server RADIUS host [IP address of your RADIUS box / AD machine running NPS] key [key]
radius-common-pw [key]
aaa authentication telnet console RADIUS LOCAL
aaa authentication ssh console RADIUS LOCAL
aaa authentication https console RADIUS LOCAL
aaa authentication http console RADIUS LOCAL

On a Cisco switch:

This example shows local authentication, which lets you Telnet into the router with username “cisco” and password “cisco.”

aaa new-model
username cisco password 0 cisco
line vty 0 4
transport input telnet

In order to test authentication with SSH, you have to add to the previous statements in order to enable SSH.

ip domain-name host.domain.tld
crypto key generate rsa
ip ssh time-out 60
ip ssh authentication-retries 2

If you want to prevent non-SSH connections, add the transport input ssh command under the lines to limit the router to SSH connections only.

line vty 0 4
transport input ssh
cry key gen rsa
ip ssh time-out 30
ip ssh version 2
line vty 0 4
transport input ssh

On a Juniper switch or firewall running JunOS:

set system authentication-order [radius password]
set system radius-server [IP Address of DC running NPS] secret [key]
set system radius-server [IP Address of DC running NPS] source-address [IP Address of interface that will communicate to DC]
set system radius-options password-protocol mschap-v2
set system login user [username] full-name "[Full User Name]" uid 9999 class super-user
# NOTE this erases your local password, so that ONLY the Domain password is allowed. This is more secure but more of a PITA if your NPS box craps out.
delete system login user [username] authentication encrypted-password