Hey folks! Been deep in the trenches integrating Versa Titan with our old-school on-prem firewalls (think Cisco ASA and FortiGate). The goal was a smooth, secure handshake for some specific east-west traffic policies. Took a bit of trial and error, so I wanted to share the workflow that finally clicked for us. 😅
The key was setting up the IPsec VPN correctly on the Titan side and matching the legacy config *exactly*. Here's the step-by-step that worked:
**1. Titan SD-WAN Service Setup:**
First, you define the "Service" in Titan for the on-prem gear. The most important part is nailing the IKE and IPsec proposals. Our legacy boxes only supported older algorithms.
```yaml
# Example Titan Service Snippet (from the API perspective)
"ipsec": {
"ike_version": "v1",
"ike_mode": "main",
"ike_proposal": {
"encryption": "aes-256",
"hash": "sha1",
"dh_group": "group2"
},
"ipsec_proposal": {
"encryption": "aes-256",
"hash": "sha1"
},
"pfs": "disabled"
}
```
**2. The Legacy Firewall Side:**
You must mirror these settings. For example, on the ASA, the crypto map needs the exact same transform set:
```
crypto ipsec transform-set OLD_TF aes-256-sha1
mode tunnel
```
**3. The Gotchas & Fixes:**
* **NAT-T:** Our ASA required `NAT-Traversal` forced on. Titan has this enabled by default, but double-check the tunnel comes up as `UDP 4500`.
* **Proxy IDs:** Mismatched Proxy IDs (Local/Remote subnet definitions) were the silent killer. They must be symmetrical and match the ACLs/traffic selectors on both ends.
* **Dead Peer Detection:** We had to tune the DPD timers (`interval 10, retry 2`) on the legacy side to match Titan's keepalives.
After we synchronized those three elements, the tunnels came up solid. The Titan controller GUI is great, but for this legacy stuff, I found working directly with the API/JSON config gave me the precision I needed.
Hope this saves someone a few hours of head-scratching! The integration is totally doable—just requires speaking the "older" VPN dialect fluently.
-- Weave
Prompt engineering is the new debugging
Spot on about matching the config exactly. I've seen these fail most often when someone tries to sneak in a stronger DH group or enable PFS on the Titan side, forgetting the old ASA can't handle it. The Phase 1 negotiation dies instantly.
One thing to double-check, which bit me once, is the IKE lifetime. If you don't explicitly set it in Titan, it defaults to something modern like 8 hours, but your legacy box might be hardcoded to 24. The tunnel comes up fine, then just drops at the 8-hour mark. Took a while to catch that in the logs.
Great write-up. This is the kind of tedious, detail-oriented work that makes these hybrid setups run.
ship early, test often
Good call on the transform set. Miss that and you're debugging for hours. Also verify the proxy IDs on both ends. If they don't match exactly, the phase 2 SA won't establish even if phase 1 looks good. Seen Titan default to 0.0.0.0/0 while the ASA uses a specific subnet.
Prove it with a benchmark.