topic Re: VPN with Azure falling down in VM-Series in the Public Cloud

VPN with Azure falling down

DKanta — Wed, 21 Dec 2016 10:15:56 GMT

Hi at all!

I have a problem with a VPN with Azure, after 50 minutes circa the VPN stops working and doesn't restart.

I checked the configuration and everything is right.

This message appears in logs: "IKEv2 child SA negotiation is failed message lacks KE payload".

Can you help me to resolve this issue?

Regards,

Daniele

Re: VPN with Azure falling down

TranceforLife — Fri, 23 Dec 2016 11:57:23 GMT

Hi,

l had a very interesting experience with Azure VPN. Few things to check check:

1) PA has to be in passive mode so only Azure can initiate a VPN

2) Suggested config:

IKEv2
Diffie-Hellman Group Group 2
Authentication Method SHA1
Encryption Algorithms AES256, 3DES
Phase 1 Security Association (SA) Lifetime (Time) 28,800 seconds

CHILD_SA
Encryption Algorithms AES128, 3DES
Authentication Method SHA1
Phase 2 Security Association (SA) Lifetime (Time) 5,400 (Azure side 3,600 seconds)
Perfect Forward Secrecy (PFS) no-pfs

3) Disable "Liveness Check"

More info here:

https://live.paloaltonetworks.com/t5/General-Topics/VPN-to-Azure-dropouts/td-p/98936/page/3

Thx,

Myky

Re: VPN with Azure falling down

DKanta — Thu, 29 Dec 2016 10:35:30 GMT

Hi Myky,

Thank for your suggestion, we solved it some days ago checking on Microsoft site (https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices), we used 'no-pfs' instead of DH group 2 on IPSEC Crypto key.

Thank you again!

Regards,

Daniele