Errors in S2S VPN configuration.

M.Ochoa — Fri, 17 May 2024 00:27:55 GMT

Hello, I am configuring a site to site VPN between a Palo Alto Firewall and un Firewall Fortinet, but despite several attempts we are not able to get it to go up either in phase 1 or in phase two in the logs of Palo Alto you can see:

2024-05-16 23:47:12.205 +0000 [INFO]: { 3: }: received IKE request x.x.x.x[500] to x.x.x.x[500], found IKE gateway VPN-XXX
2024-05-16 23:47:12.205 +0000 [PNTF]: { 3: }: ====> IKEv2 IKE SA NEGOTIATION STARTED AS RESPONDER, non-rekey; gateway VPN-XXX <====
====> Initiated SA: X.X.X.X[500]-X.X.X.X[500] SPI:54bb55b0e9b865aa:5e93ae9ae2b86aef SN:122885 <====

2024-05-16 23:47:12.205 +0000 [PWRN]: { 3: }: x.x.x.x[500] - x.x.x.x[500]:0x55ec93f34470 ignoring unauthenticated notify payload (NAT_DETECTION_SOURC
2024-05-16 23:47:12.205 +0000 [PWRN]: { 3: }: x.x.x.x[500] - x.x.x.x[500]:0x55ec93f34470 ignoring unauthenticated notify payload (NAT_DETECTION_DESTI
2024-05-16 23:47:12.205 +0000 [PWRN]: { 3: }: x.x.x.x[500] - x.x.x.x[500]:0x55ec93f34470 ignoring unauthenticated notify payload (16430)

Any recommendations of what may be happening ?

Re: Errors in S2S VPN configuration.

kiwi — Fri, 17 May 2024 14:23:55 GMT

Hi @M.Ochoa ,

Looks very similar to what's happening here:

https://live.paloaltonetworks.com/t5/general-topics/ike-v2-asa-vs-pa/td-p/230814

A good place to start is to make sure the IKE and IPSec parameters match on both ends. This might be as simple as a mismatching PSK.

If you can't find what's wrong then I'd suggest to crank up the debug log level to get more verbose logging and get more details:

How to Troubleshoot IPSec VPN connectivity issues

Kind regards,

-Kim.

topic Errors in S2S VPN configuration. in General Topics

Errors in S2S VPN configuration.

Re: Errors in S2S VPN configuration.