topic Re: Issues without using Proxy IDs on IPSEC tunnel in General Topics

Issues without using Proxy IDs on IPSEC tunnel

Param_Upadhyay — Mon, 07 Aug 2023 23:39:26 GMT

We are running into issues with VPN when we chose not to use PROXY ids between two PA firewalls.

We see it works fine when we add the proxy ids, but we shouldn't need to if both of them are Palo Alto, isn't it?

We see phase 2 keeps failing and the tunnel would not come up.

"IKE phase-2 negotiation failed when processing proxy ID. Cannot find matching phase-2 tunnel for received proxy ID..."

We have already tried disabling the gateways, deleting and recreating the gateway as well as the tunnel again - doesn't help either.

Made sure there were no stale sessions still existing.

We lastly also tried to upgrade to the preferred version 10.1.10-h1 - and we still see the same behavior.

Any help or suggestions are appreciated. TIA

@Didar_Bajwa

Re: Issues without using Proxy IDs on IPSEC tunnel

BPry — Tue, 08 Aug 2023 13:20:57 GMT

@Param_Upadhyay,

You cut out the most important part from a troubleshooting aspect; what does that error say the received local id and received remote id are?

Re: Issues without using Proxy IDs on IPSEC tunnel

UtkarshKumar — Tue, 08 Aug 2023 17:10:07 GMT

@BPry The only error we see is:

The strange part is as soon as we put in the Proxy ID on both the PA firewall tunnel comes up correctly with no issues. If we remove the proxy Phase-2 fails and we see Local ID and Remote ID still the same. We have already deleted the IKE gateway and IPSEC tunnel as well completely but still once we try and build the tunnel without proxy Phase-2 fails with same error.

Customer has also upgraded the software version to 10.1.10-h1.

Re: Issues without using Proxy IDs on IPSEC tunnel

Param_Upadhyay — Fri, 11 Aug 2023 19:32:32 GMT

Hi @BPry If you could please review this and help us here. Thanks

Re: Issues without using Proxy IDs on IPSEC tunnel

UtkarshKumar — Mon, 14 Aug 2023 16:39:05 GMT

Any Help?

We have also rebooted a couple of times but still same

Re: Issues without using Proxy IDs on IPSEC tunnel

UtkarshKumar — Thu, 24 Aug 2023 16:37:27 GMT

Hi Team

Any help in understanding what could have caused this issue?

Re: Issues without using Proxy IDs on IPSEC tunnel

Remo — Sun, 27 Aug 2023 07:08:08 GMT

Could you show us the ipsec configurations of both sides? Because the screenshot you showed actually means that there are proxy IDs configured and because of that your firewall is not able to find a matching entry. If the tunnel is only built up in the direction from your customer to you, then your proxy IDs can be empty as your firewall will accept any entry (as long there is only one. If there are more then you will have issues as the tunnel changes over and over).

Re: Issues without using Proxy IDs on IPSEC tunnel

CesarSanchez — Tue, 29 Aug 2023 02:14:06 GMT

Does the P2 makes match in both FW? Can I see your configuration in both sides?