topic Re: VPN cannot work between two PA in General Topics

VPN cannot work between two PA

kevinospf — Mon, 07 Aug 2023 14:53:17 GMT

Hi VPN is configured at two PA based on the below link and the two PA can ping each other, but the vpn cannot work. I tested it with below commands. Anyone can help to fix it? Thank you

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGkCAK

admin@PA-VM> test vpn ipsec-sa

Start time: Aug.07 07:48:19
Initiate 2 IPSec SA.

admin@PA-VM>
admin@PA-VM> show vpn ipsec-sa

There is no IPSec SA found.

admin@PA-VM>
admin@PA-VM> show vpn ike-sa

There is no IKEv1 phase-1 SA found.

There is no IKEv1 phase-2 SA found.

IKEv2 SAs
Gateway ID Peer-Address Gateway Name Role SN Algorithm Established Expiration Xt Child ST
---------- ------------ ------------ ---- -- --------- ----------- ---------- -- ----- --
2 10.2.0.1 IKE-Gateway123 Init 16 PSK/ / / 5 2 INIT sent

IKEv2 IPSec Child SAs
Gateway Name TnID Tunnel ID Parent Role SPI(in) SPI(out) MsgID ST
------------ ---- ------ -- ------ ---- ------- -------- ----- --
IKE-Gateway123 2 IPSec-Tunnel123 8 16 Init 00000000 00000000 00000000 GetSPI done
00000000 00000000 00000000 GetSPI done

Show IKEv2 SA: Total 1 gateways found. 1 ike sa found.

Re: VPN cannot work between two PA

akuzhuppilly — Mon, 07 Aug 2023 15:26:58 GMT

Hello @kevinospf

You can find more details about what is causing the failure in the system logs and the ikemgr logs (less mp-log ikemgr.log).

The following KB might be helpful:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC

Re: VPN cannot work between two PA

kevinospf — Mon, 07 Aug 2023 19:00:31 GMT

Thanks for your reply!

IPSect tunnel is up, but users behind PA cannot ping user in other side. I got the below result after entering command "show routing route"

The nexthop is "0.0.0.0". I checked virtual router configuration. I did not find something wrong. Is this security issue or routing issue?

Re: VPN cannot work between two PA

akuzhuppilly — Tue, 08 Aug 2023 03:58:40 GMT

The routing is pointing to the tunnel interface, that should be fine.

Can you provide the output for the below commands from both the firewalls (remember to remove confidential details such as IPs)
> show vpn ike-sa detail gateway <gateway-name>

> show vpn ipsec-sa tunnel <tunnel-name>

> show vpn flow tunnel-id <tunnel-id-number>

Make sure the firewalls are allowing the user traffic.

Re: VPN cannot work between two PA

kevinospf — Tue, 08 Aug 2023 14:14:18 GMT

the issue is resolved due to your question. Thanks for your questions