PALO ALTO to AWS site to site VPN not established

SamuelCardoz — Thu, 26 May 2022 03:41:34 GMT

Issue:
PALO ALTO to AWS IPsec site to site VPN not able to established.

Situation

Since AWS will provide two VPN tunnel by default.
One of the VPN tunnel is established using the same public IP of PALO ALTO while the other VPN tunnel not able to established.

Here is the logs
2022-05-24 12:55:40.905 +0800 [PNTF]: { 39: }: ====> PHASE-1 NEGOTIATION FAILED AS RESPONDER, MAIN MODE <====
====> Failed SA:x.x.x.x[500]-x.x.x.x[500] cookie:ba86d45b27ded4d0:ab606e5c9f109876 <==== Due to timeout.

I can able to ping the AWS IP on the PALO ALTO.
Packet capture show that PALO ALTO send traffic to AWS but as per AWS support they did not received traffic from the PALO ALTO.

Any idea what is the cause why the other tunnel does not established.?

Re: PALO ALTO to AWS site to site VPN not established

LAYER_8 — Tue, 14 Jun 2022 00:54:02 GMT

Do you have your VPC rules that allow inbound internet traffic, or whitelisting traffic from your NGFW public IP?

topic PALO ALTO to AWS site to site VPN not established in General Topics

PALO ALTO to AWS site to site VPN not established

Re: PALO ALTO to AWS site to site VPN not established