topic VPN Proxies in General Topics

VPN Proxies

perton — Mon, 28 Aug 2023 09:42:26 GMT

I have a VPN tunnel, which is up and running. I have two proxyIDs in the tunnel with the same local address but different remote addresses.

I can only get one proxy to connect.

For example, I currently have proxyID1 connected and can ping the other side. In the CLI, if I type test VPN ipsec-sa tunnel tunnel-name-proxyID2. It does not come up. I also tried doing a test VPN ike-sa gateway gateway-name, but It still does not work.

Now, if I delete proxyID1, ProxyID2 connects.

It appears that only the first proxy gets connected in the proxy list.

Any Ideas?

Re: VPN Proxies

Remo — Mon, 28 Aug 2023 10:09:51 GMT

Sound like there is a network mismatch betwenn your and the other side. Did you check if the networks match on both sides?

Re: VPN Proxies

Raido_Rattameister — Mon, 28 Aug 2023 13:07:20 GMT

Do you know what is peer firewall brand?

Merakis implementation of IKEv2 for example can bring up only 1 tunnel at a time because it will put all different subnets into single SA. Palo has SA per every subnet.

https://documentation.meraki.com/MX/Site-to-site_VPN/IKEv1_and_IKEv2_for_non-Meraki_VPN_Peers_Compared

"As with the previous capture, the MX is attempting to build a single SA that covers all 4 of the involved subnets, but in this case, the peer responds with only a single Traffic Selector pair, indicating it only wants the tunnel to cover 192.168.2.0/24 and 10.5.20.0/24."