topic Re: IPSec tunnel not working in Next-Generation Firewall Discussions

IPSec tunnel not working

HitendraP — Wed, 22 Mar 2023 05:33:32 GMT

Hi..

I have IPSec tunnel between Palo alto 820 and Cyberoam firewall. But It's not getting up. Neither Phase 1 nor Phase 2. Even I am not reachable to other end public ip. Suggest me.

Re: IPSec tunnel not working

Raido_Rattameister — Wed, 22 Mar 2023 05:41:04 GMT

Initiate vpn from Cyberoam side towards Palo.

Do you see any sessions from Cyberoam public IP in "Monitor > Traffic" or "Monitor > Session Browser" on Palo side?

If yes check "Monitor > System" and use filter below. Do you see any errors that might reveal why tunnel don't come up?

( subtype eq vpn )

Re: IPSec tunnel not working

HitendraP — Wed, 22 Mar 2023 06:33:39 GMT

Found this error in System log - IKE phase-1 negotiation is failed as initiator, main mode.

Re: IPSec tunnel not working

Raido_Rattameister — Wed, 22 Mar 2023 06:36:49 GMT

This error is not helpful as if Palo is "initiator" then you need to check logs at Cyberoam side.

Only recipient side will know why connection failed. Recipient will not share failure reason with initiator.

If you want to analyze logs from Palo side you need to initiate connection from Cyberoam towards Palo..

Re: IPSec tunnel not working

HitendraP — Wed, 22 Mar 2023 08:28:18 GMT

Error from Cyberoam firewall

Re: IPSec tunnel not working

nikoolayy1 — Wed, 22 Mar 2023 12:00:11 GMT

I think @Raido_Rattameister suggested to you to switch the responder to be Palo Alto.

How to make Palo Alto Networks firewalls Responder-only in an IPSec tunnel

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClMZCA0

You will have to do some investigations or debugs like after making Palo Alto responder if the error is not clear to enable IKE debug or check for global counter drops or packet captures if the traffic is even reaching the Palo Alto firewall at all or if a security policy on Palo Alto is dropping it:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcKCAS

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PORsCAO

https://live.paloaltonetworks.com/t5/general-topics/knowledge-sharing-palo-alto-checking-for-drops-rejects-discards/td-p/402102

Re: IPSec tunnel not working

Raido_Rattameister — Wed, 22 Mar 2023 12:26:46 GMT

Does Cyberoam have 1 or more WAN IPs?

According to https://docs.sophos.com/nsg/sophos-firewall/17.5/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/LogMessages.html error message 17842 shows success (<connectionname>, EST-P1-MM: Response to establishment request from <peeris> peer <peerrequesterip> successful) and error 17856 seems to mean that Cyberoam replied but did not get any answer after that (<connectionname>, EST-P1: max number of retransmissions <count> reached STATE_MAIN_I1. No response (or no acceptable response) to first IKE message.).

So first suspicion is that Palo sends IKE packet to Cyberoam WAN IP1 and Cyberoam replies to Palo from WAN IP2.

If this is the case then you need static route in Cyberoam to send return packets from WAN IP1 to Palo.

If Cyberoam don't have 2 IPs then check that Palo firewall policy permits incoming IPSec traffic from Cyberoam IP and would not drop those packets.

Re: IPSec tunnel not working

LACOUSTICS — Thu, 23 Mar 2023 08:51:10 GMT

Hi;
On Monitor > Traffic, check if you have any deny traffic from/to public IP address of the remote site.
When it's about phase 1 of IPsec, most of the time is about IKE parameters or the traffic is may be denied somewhere