topic IKE phase 2 negotiation fail in General Topics

IKE phase 2 negotiation fail

przyboro — Tue, 12 Aug 2014 22:27:55 GMT

Hi,

I'm having a hard time bringing up a VPN tunnel from my PA-5020 to a Cisco firewall. I'm getting the following:

'IKE phase-2 negotiation failed when processing proxy ID. cannot find matching phase-2 tunnel for received proxy ID. received local id: 10.13.247.43/32 type IPv4_address protocol 0 port 0, received remote id: 192.168.10.200/32 type IPv4_address protocol 0 port 0.'

My search indicates that it's a mismatch with the Cisco firewall ACL. Would I be correct in assuming that their ACL references address protocol 0 port 0 instead of the specific ports we agreed upon during the design?

Thanks.

Re: IKE phase 2 negotiation fail

HULK — Tue, 12 Aug 2014 22:40:23 GMT

Hello przyboro,

Generally speaking, most of the customer refers only local and remote subnet. As per the logs, please ensure that PAN is configured with Local PROXY ID as 192.168.10.200/32 and remote PROXY ID as 10.13.247.43/32. Please find below an example:

Notes: If you have specified any port and protocol in Cisco ACL, then only, it is required to add on PAN firewall.

Hope this helps.

Thanks

Re: IKE phase 2 negotiation fail

przyboro — Wed, 13 Aug 2014 19:34:53 GMT

Thank you for this information. I will be testing this out shortly.

Re: IKE phase 2 negotiation fail

przyboro — Fri, 22 Aug 2014 18:23:22 GMT

Sorry for the late reply. Missing proxy-ID was the problem. Fixed now. Thank you!