VPN PA-400 to PFSense

admin — Fri, 21 Mar 2025 22:09:43 GMT

Hi all!

I've created an IPsec VPN site-to-site between Palo Alto and PFSense.

We are facing problems because the tunnel doesn't connect. We see the errors below on Monitor Logs:

Error1 = IKEv2 IKE SA negotiation is started as responder, non-rekey. Initiated SA: IP_PALO_ALTO[500]-IP_PFSENSE[33848] SPI:1719700341f53997:4c83ee594abb7b38.

Error2 = ignoring unauthenticated notify payload (NAT_DETECTION_SOURCE_IP

Do you know what could be the problem?

The VPN worked with another firewall.

We already tried:

Change psk
Change the internet line
Change encryption options
Check date/time
Check policies
Check ports 500 and 4500

Help!

Re: VPN PA-400 to PFSense

kiwi — Tue, 25 Mar 2025 09:33:48 GMT

Hi @admin ,

Further debugging is required.

I'd start by confirming both VPN peers can actually reach each other.

Start off by these troubleshooting tips:
How to Troubleshoot IPSec VPN connectivity issues

Here are some more debugging tips and usecases:
https://live.paloaltonetworks.com/t5/support-faq/support-faq-how-to-troubleshoot-ipsec-vpn-connectivity-issues/ta-p/590317

Kind regards,

-Kim.

topic VPN PA-400 to PFSense in Next-Generation Firewall Discussions

VPN PA-400 to PFSense

Re: VPN PA-400 to PFSense