Incorrect object displayed on PA-5220 during Tunnel negotiation.

JoeJohnson — Thu, 28 Jul 2022 08:31:21 GMT

This is a slightly confusing issue that I am facing so please bare with me with regards to the explanation.

We have a PA-5220 configured with multiple IPSec Tunnels connecting to community sites, the community sites have either a PA-220 or PA-440 on the other end. Recently when setting up a new IPSec Tunnel (Southmead_Health) we noticed one of the community sites go down (BEH_Lorry). When checking the monitor it appears that the negotiation process is displaying the Southmead_Health object for the ike start and then the BEH_Lorry for all further steps as below:

The BEH_Lorry Tunnel completes and comes up as expected but we are really confused as to why the process is picking up the wrong object during the tunnel negotiation. Any advice on what to look at would be appreciated. We have 20+ tunnels configured and have never come across something like this before.

Re: Incorrect object displayed on PA-5220 during Tunnel negotiation.

reaper — Thu, 04 Aug 2022 10:09:15 GMT

do all remote sites have a static IP/unique IP and are they configured as such (static remote IP)

if you're using 'dynamic' this could be the cause of this issue, you can remediate this by setting peer identification in the tunnel configuration so the dynamic peers identify themselves with a unique attribute (fqdn, email,....)

topic Re: Incorrect object displayed on PA-5220 during Tunnel negotiation. in General Topics

Incorrect object displayed on PA-5220 during Tunnel negotiation.

Re: Incorrect object displayed on PA-5220 during Tunnel negotiation.