Google Cloud VPN IKE-SA-INIT packets being dropped

qdimclark — Thu, 14 Jul 2022 16:22:53 GMT

I built a site-to-site VPN between GCP and a PA3250, which is not working. Surely, I'm missing something.

The GCP vpn points to the same interface and IP that other VPNs successfully use on the Palo.

I added a Sec policy to allow the GCP IP and the Palo IP to set up Phase 1. However, the Palo drops the inbound IKE-SA-INIT packets. They are getting caught by the INTRAZONE Default rule.

I've verified the IP addresses, the IKE paramters, the PSK, and the Sec policy. In fact I've rebuilt this a few times by completely deleting everything on the GCP side and the related configs in the Palo.

To test I set up a VPN from the same GCP project to a different PA3250 with a different IP address and that tunnel works flawlessly.

Everytime I've rebuilt the VPNs I get a different public IP from GCP. So, it's not an issue with their IP addresses.

What appears to be happening, but I can't verify is that the PA3250 with the issue Policy Denies the packets and just drops all subsequent packets from that address. Like it's cached somewhere. As a test I deleted the VPN config from both sides before leaving yesterday. I created them from scratch this morning, about 14 hours later, with the same results. The first packet gets denied and nothing else.

When I run test vpn ike-sa gateway ******** from the cli, a packet capture shows that the outbound packet from the Palo gets dropped.

I've scoured both PA3250s for the difference, but only come up with the Palo IP address.

Suggestions?

topic Google Cloud VPN IKE-SA-INIT packets being dropped in Next-Generation Firewall Discussions

Google Cloud VPN IKE-SA-INIT packets being dropped