IPsec tunnel doesn't connect - no errors seen

1treelanedrv — Fri, 28 Mar 2025 20:45:10 GMT

Hi everyone, do you have any idea why this tunnel will not establish?

I'm trying to connect with a partner company. The IPsec config is identical across two templates. Both sites have their own unique public IP and are connecting to the same peer IP on the partner's side. The Secondary_Gateway connects fine. But this Primary_Gateway only shows this in the ikemgr.log.

2025-03-28 10:45:44.375 -0500 debug: sysd_msg_send(daemon/panike_sysd_if.c:2487): iked sysd msg enqueue: ike_debug_handler
2025-03-28 10:45:49.287 -0500 debug: pan_msg_process(daemon/panike_sysd_if.c:2849): iked rcv msg ike_stats_handler(18).
2025-03-28 10:45:49.299 -0500 debug: sysd_msg_send(daemon/panike_sysd_if.c:2487): iked sysd msg enqueue: ike_stats_handler
2025-03-28 10:45:52.404 -0500 debug: pan_msg_process(daemon/panike_sysd_if.c:2849): iked rcv msg ike_stats_handler(18).
2025-03-28 10:45:52.416 -0500 debug: sysd_msg_send(daemon/panike_sysd_if.c:2487): iked sysd msg enqueue: ike_stats_handler
2025-03-28 10:46:03.083 -0500 debug: pan_msg_process(daemon/panike_sysd_if.c:2849): iked rcv msg ike_sa_handler(13).
2025-03-28 10:46:03.084 -0500 [INFO]: { 1: }: Primary_Gateway: IKEv2 SA test initiate start.
2025-03-28 10:46:03.099 -0500 [PNTF]: { 1: }: ====> IKEv2 IKE SA NEGOTIATION STARTED AS INITIATOR, non-rekey; gateway Primary_Gateway <====
====> Initiated SA: 10.1.1.1[500]-10.2.2.2[500] SPI:1a14bc5f2ee04e45:0000000000000000 SN:14 <====
2025-03-28 10:46:03.099 -0500 [DEBG]: { 1: 1}: ikev2_initiate: child_sa created: id 23
2025-03-28 10:46:03.183 -0500 [DEBG]: 10.1.1.1[500] - 10.2.2.2[500]:(nil) 1 times of 248 bytes message will be sent over socket 1024
2025-03-28 10:46:03.183 -0500 debug: sysd_msg_send(daemon/panike_sysd_if.c:2487): iked sysd msg enqueue: ike_sa_handler
2025-03-28 10:46:07.540 -0500 debug: pan_msg_process(daemon/panike_sysd_if.c:2849): iked rcv msg ipsec_sa_handler(14).
2025-03-28 10:46:07.540 -0500 [DEBG]: { 1: 1}: ikev2_initiate: child_sa created: id 24
2025-03-28 10:46:07.541 -0500 debug: sysd_msg_send(daemon/panike_sysd_if.c:2487): iked sysd msg enqueue: ipsec_sa_handler
2025-03-28 10:46:08.001 -0500 [DEBG]: { 1: }: IKEv2 retransmit, child id 0, retry cnt 1 limit 10
2025-03-28 10:46:08.001 -0500 [DEBG]: 10.1.1.1[500] - 10.2.2.2[500]:(nil) 1 times of 248 bytes message will be sent over socket 1024
2025-03-28 10:46:14.841 -0500 debug: pan_msg_process(daemon/panike_sysd_if.c:2849): iked rcv msg ike_sa_handler(13).
2025-03-28 10:46:14.841 -0500 debug: sysd_msg_send(daemon/panike_sysd_if.c:2487): iked sysd msg enqueue: ike_sa_handler
2025-03-28 10:46:18.000 -0500 [DEBG]: { 1: }: IKEv2 retransmit, child id 0, retry cnt 2 limit 10
2025-03-28 10:46:18.000 -0500 [DEBG]: 10.1.1.1[500] - 10.2.2.2[500]:(nil) 1 times of 248 bytes message will be sent over socket 1024
2025-03-28 10:46:18.052 -0500 debug: pan_msg_process(daemon/panike_sysd_if.c:2849): iked rcv msg ipsec_sa_handler(14).
2025-03-28 10:46:18.053 -0500 debug: sysd_msg_send(daemon/panike_sysd_if.c:2487): iked sysd msg enqueue: ipsec_sa_handler
2025-03-28 10:46:21.014 -0500 debug: pan_msg_process(daemon/panike_sysd_if.c:2849): iked rcv msg tunnel_cfg_handler(16).
2025-03-28 10:46:21.014 -0500 debug: sysd_msg_send(daemon/panike_sysd_if.c:2487): iked sysd msg enqueue: tunnel_cfg_handler
2025-03-28 10:46:38.000 -0500 [DEBG]: { 1: }: IKEv2 retransmit, child id 0, retry cnt 3 limit 10

Re: IPsec tunnel doesn't connect - no errors seen

TomYoung — Sat, 29 Mar 2025 02:54:43 GMT

Hi @1treelanedrv ,

If you don't see anything under Monitor > Logs > System, the next step is to check if you see the packets under Monitor > Logs > Traffic. You should see 2-way traffic or drops. In order to see drops, you may need to Override the interzone-default rule and configure logging.

Thanks,

Tom

Re: IPsec tunnel doesn't connect - no errors seen

1treelanedrv — Mon, 31 Mar 2025 15:59:39 GMT

Today I issued "test vpn ike-sa" at 10:24.

Re: IPsec tunnel doesn't connect - no errors seen

1treelanedrv — Mon, 31 Mar 2025 16:36:14 GMT

Well, I only had "logging at end" enabled for this rule. I've enabled "logging at start". Which, as you can imagine, shows the opening of the session. No two-way. I don't think they are responding.

The other firewall doesn't show any logs even though its VPN shows connected after doing the test vpn ike-sa. haha

I just don't know.

I'm meeting with them later today. If we find the fix, I'll update this thread.

Re: IPsec tunnel doesn't connect - no errors seen

TomYoung — Mon, 31 Mar 2025 16:55:05 GMT

Hi @1treelanedrv ,

Correct. Your System and Traffic logs both confirm no response from the other side.

Thanks,

Tom

Re: IPsec tunnel doesn't connect - no errors seen

1treelanedrv — Fri, 04 Apr 2025 16:59:27 GMT

Confirmed with other side that they accidentally deleted the config for my second connection. But we all know it was no accident. 🤣🤣

topic Re: IPsec tunnel doesn't connect - no errors seen in VM-Series in the Private Cloud

IPsec tunnel doesn't connect - no errors seen

Re: IPsec tunnel doesn't connect - no errors seen

Re: IPsec tunnel doesn't connect - no errors seen

Re: IPsec tunnel doesn't connect - no errors seen

Re: IPsec tunnel doesn't connect - no errors seen

Re: IPsec tunnel doesn't connect - no errors seen