Configuring a site-to-site VPN connection

IPSec with Internet Security Association and Key Management Protocol (ISAKMP) has been around for quite some time and has seen many upgrades in the form of improved algorithms and standards. Because so many legacy systems remain online far beyond their capability of adopting newer and stronger cryptography, many vendors, including Palo Alto Networks, keep including older algorithms in the available Crypto suite. This is so connections can still be maintained with those legacy systems or, simply, to provide extremely rudimentary and computationally cheap protection against network sniffing. This provides a wide range of available options; however, you might still encounter mismatching options, most commonly in the available Diffie-Hellman (DH) groups.

Establishing a site-to-site tunnel happens in two stages. In the first stage, which is also called Phase-1 or Internet Key Exchange (IKE), all the information that is needed to arrive at a...