topic Re: Ike -generic event : vendor id payload ignored in General Topics

Ike -generic event : vendor id payload ignored

fatboy1607 — Fri, 09 Sep 2016 05:57:16 GMT

We are seeing continous ike genric event for vendor id payload ignored , tunnel is up traffic getting encrypted and decrypted.

what exactly does above error say.

Re: Ike -generic event : vendor id payload ignored

TranceforLife — Fri, 09 Sep 2016 08:08:36 GMT

Hello,

Please could post an output of te command below:

> tail lines 100 mp-log ikemgr.log

Re: Ike -generic event : vendor id payload ignored

fatboy1607 — Fri, 09 Sep 2016 09:30:53 GMT

2016-09-08 10:05:30 [PROTO_NOTIFY]: ====> IKEv2 IKE SA NEGOTIATION STARTED AS RESPONDER, non-rekey <====
====> Initiated SA: X.X.X.X[500]-X.X.X.X[500] SPI:34a2990a7a92484b:efca7a95900a177b SN:15994 <====
2016-09-08 10:05:30 [PROTO_WARN]: 15994:x.x.x.x[500] - x.x.x.x[500]:0x9247c08:ignoring unauthenticated notify payload (NAT_DETECTION_SOURCE_IP)
2016-09-08 10:05:30 [PROTO_WARN]: 15994:x.x.x.x[500] - x.x.x.x[500]:0x9247c08:ignoring unauthenticated notify payload (NAT_DETECTION_DESTINATION_IP)
2016-09-08 10:05:30 [PROTO_WARN]: 15994:x.x.x.x[500] - x.x.x.x[500]:0x9247c08:vendor id payload ignored
2016-09-08 10:05:30 [PROTO_WARN]: 15994:x.x.x.x[500] - x.x.x.x[500]:0x9247c08:vendor id payload ignored
2016-09-08 10:05:30 [PROTO_WARN]: 15994:x.x.x.x[500] - x.x.x.x[500]:0x9247c08:vendor id payload ignored
2016-09-08 10:05:30 [PROTO_WARN]: 15994:x.x.x.x[500] - x.x.x.x[500]:0x9247c08:vendor id payload ignored
2016-09-08 10:05:30 [INFO]: 15994:x.x.x.x[500] - x.x.x.x[500]:0x916df28:authentication result: success
2016-09-08 10:05:30 [PROTO_NOTIFY]: ====> IKEv2 CHILD SA NEGOTIATION STARTED AS RESPONDER, non-rekey <====
====> Initiated SA: x.x.x.x[500]-x.x.x.x[500] message id:0x00000001 parent SN:15994 <====

Re: Ike -generic event : vendor id payload ignored

TranceforLife — Fri, 09 Sep 2016 10:15:09 GMT

Hi,

Thanks for the logs. Is this VPN between Azure?

Thx,

Myky

Re: Ike -generic event : vendor id payload ignored

fatboy1607 — Fri, 09 Sep 2016 10:15:57 GMT

Yes it is with Azure.

Re: Ike -generic event : vendor id payload ignored

TranceforLife — Fri, 09 Sep 2016 15:24:59 GMT

Hi,

What is your PAN-OS version?

We had a strange issue with this Azure s2s VPN.

Please could you make sure you tick the box "passive mode" on IKE GATEWAY

I could see it is a "responder" only but still we had similar behaviour. As soon as we ticked that box all went smoothly.

Thx,

Myky

Re: Ike -generic event : vendor id payload ignored

fatboy1607 — Fri, 09 Sep 2016 10:57:26 GMT

We have Passive mode enabled , still getting same error.

Re: Ike -generic event : vendor id payload ignored

TranceforLife — Mon, 12 Sep 2016 23:08:05 GMT

Hi,

l think these warning messages are normal.

But to be clear, open a TAC case.

Thx,

Myky

Re: Ike -generic event : vendor id payload ignored

KIMvdLinden — Tue, 08 Sep 2020 06:58:15 GMT

Did you end up finding it?

Re: Ike -generic event : vendor id payload ignored

bit_byte — Wed, 30 Sep 2020 12:40:40 GMT

@TranceforLife

Hi have u got your answer vendor id payload ignored , why you were receiving that message

Re: Ike -generic event : vendor id payload ignored

alexg_8 — Mon, 09 Aug 2021 17:38:58 GMT

We are having this issue with Azure VWAN S2S VPN gateway, specifically with instance 0 of the Azure VPN gateway (they run them in active/active pairing). Instance 1 has been working without issue. Rebooting our HA pair of 3050's, I can bring the VPN tunnel up, however that does not last and it will begin failing after a few hours. Weirdly, out of 4 sites we have with 3050's in HA pairing, only 2 of the sites are having issues with Azure VPN instance 0. PA software version 9.0.9 across all sites, managed with Panorama. Involving PA support now and I will report back if we find a resolution.

Re: Ike -generic event : vendor id payload ignored

alexg_8 — Wed, 11 Aug 2021 14:05:58 GMT

Sharing another update here. Microsoft support identified that the issue, currently, is that IKE traffic destined for Azure VPN gateway instance 0 is being received on instance 1. They insisted that the issue was with routing on our end, however they provided packet captures proving that the traffic had the destination public IP for instance 0, yet was being received by instance 1. We're leaning towards a Microsoft/Azure routing issue. More to come.

Re: Ike -generic event : vendor id payload ignored

alexg_8 — Thu, 12 Aug 2021 12:18:14 GMT

Last update, and the ultimate resolution on our end. We tore down and deleted the S2S VPN gateway on the Azure VWAN side, as well as removed the problematic tunnels from the PA side. Once it was re-deployed, the new VPN gateway instances had new public IPs, so I setup all 8 of our tunnels (4 sites, 2 tunnels per) using the new peering IPs and it has been stable since. I know anyone who's already running production traffic out to Azure will need a couple hour maintenance window to do this, so it may not be the answer you were looking for, but we luckily hadn't migrated production traffic over it yet.

Anyone who is facing this issue and may not have the time to do a complete re-deploy, I would urge you to have Azure/Microsoft run packet captures to see if there is a routing issue on the Azure side where packets for one instance are somehow arriving at the other instance. I never heard back from our engineer if he was able to find anything as we just proceeded with the re-deploy, but all signs were pointing to that. Hope this helps someone encountering issues with Azure VWAN!

Re: Ike -generic event : vendor id payload ignored

alexg_8 — Thu, 12 Aug 2021 12:21:35 GMT

Ope. I forgot to include the part that started this whole thread. Once this was fixed, I did see the 'vendor id payload ignored' error messages disappear from our ikemgr.log.

Re: Ike -generic event : vendor id payload ignored

JagadeesanC — Tue, 03 Jan 2023 23:03:59 GMT

This could be a authentication issue, please check the pre shared key once again.

Re: Ike -generic event : vendor id payload ignored

AHorja — Fri, 03 Mar 2023 13:27:22 GMT

We just experienced the same yesterday, a VPN tunnel to Azure that was working fine for over one year suddenly stopped working.

The errors in the firewall log were ignoring unauthenticated notify payload and vendor id payload ignored. We changed the pre-shared key, restarted the Azure gateway and disabled and re-enable the tunnel in Palo Alto. The fix was to recreate the VPN connection in Palo Alto.