PaloAlto PA440 to SG230 site-2-site IPSEC VPN

Hello Alex Suslik ,

Thank you for reaching out to the community, may we know the Sophos Appliance model name and firmware version ?

SG230 firmware version 9.712-13

PA440 software version 10.1.6-h6

Hey Alex Suslik , thank you for the update, we do not have a pocket guide/best practice for UTM 9.7 to PAN OS. But we definitely have a guide between our next gen FW to PAN OS. And again UTM 9 only supports IKev1 where as next gen supports IKev2 Parameters as well. You may configure a Site-to-site IPsec tunnel by referring the KBA - https://support.sophos.com/support/s/article/KB-000036832?language=en_US
Just ensure the parameters configured on the PAN OS should be matching with one configured on the UTM 9.  

Thank you Vivek,

The Sophos SG230 is UTM9. So it also only supports IKE1 and not IKE2, correct?

Yes that's right ! Alex Suslik  

in my case SG230 provides only option "Initiate"

Is UTM9 using for IKE encryption AES-256-cbc?

So phase 1 IKE1 was successful, but not phase 2

ok, tunnel is up 

on PaloAlto side in IPSEC Crypto authentication should be set to none.

Welcome to the UTM Community, Alex - thanks for providing the answer for future members with a similar question.

Cheers - Bob