PRF - Phase 1

[spetrillo]

Hello all,

New to IPSec VPNs and trying to setup a S2S VPN from my OPNsense device to a Cisco ASA on the other side. The network engineer handling the Cisco side says I am missing PRF in phase 1, but I do not see any option for PRF. Can you point me in the right direction?

Thanks,
Steve

[nzkiwi68]

PRF stands for Pseudo-Random Function

In this case, make sure your Hash algorithm agrees with the Cisco ASA.

I have seen it whereby the hashing and PRF are set differently, we can't do that in OPNsense and it shouldn't really be needed anyway. So, we can't set a PRF, it's likely that OPNsense just uses whatever you set as the Hash algorithm as the PRF.

Tell them your PRF is SHA256.

[spetrillo]

What configuration option do I set?

[nzkiwi68]

You can't set a PRF, only a phase 1 hashing algorithm, which, will also be the PRF

[spetrillo]

Got it...thanks!