ikev2 site to site VPN between PA and ASA

msdphi — Tue, 12 Nov 2024 17:11:19 GMT

Hi All,

I have a site to site VPN configured to client's ASA.

The VPN stays stable until the phase 2 lifetime expires and then never comes up until interesting traffic is generated from client(ASA) side.

On checking the PA logs, I see a couple of errors "IKE protocol notification message received: received notify type NON_FIRST_FRAGMENTS_ALSO" and "IKE protocol notification message received: received notify type ESP_TFC_PADDING_NOT_SUPPORTED' )".

All the parameters on both sides are the same. Please help me. Need your advice here.

Re: ikev2 site to site VPN between PA and ASA

ozheng — Wed, 13 Nov 2024 03:02:36 GMT

Hello Msdphi,

IPSec is not really related to Panorama (except for pure configuration), in your case it is a tunnel getting down at expiration time, more interesting for all to post in NGFW related discussions.

From Panorama, you can configure a tunnel monitor so the regular ping may bring a new tunnel up.

Olivier

topic ikev2 site to site VPN between PA and ASA in Panorama Discussions

ikev2 site to site VPN between PA and ASA

Re: ikev2 site to site VPN between PA and ASA