topic VPN Tunnel between static Palo Alto and dynamic Fortigate in General Topics

VPN Tunnel between static Palo Alto and dynamic Fortigate

furrygolden — Sat, 30 May 2015 08:45:34 GMT

What is the exact settings in order to establish a VPN tunnel between a Palo Alto firewall that has static WAN IP address and a Fortigate that has Dynamic WAN IP address?

If both has static IP address, the tunnel works.

If Fortigate has dynamic WAN address, I cannot get the VPN working. I tried aggressive mode on both sides. Palo Alto log keeps saying IKE phase-1 negotiation failed. Couldn't find configuration for IKE phase-1 request for peer IP X.X.X.X[500], ID ipaddr:X.X.X.X.

Re: VPN Tunnel between static Palo Alto and dynamic Fortigate

pulukas — Sat, 30 May 2015 13:27:26 GMT

Check your gatway configurations. In addition to selecting aggressive mode on both sides. Your gateways need to be configured to use dynamic on one side and static on the other. And you should have local and peer identity configured. This is used as the alternative to knowing the static ip address to match the IKE phase 1. These are not necessrily real email address just matching strings in the form of email addresses, they need to be the same on both sides as a kind of "password" check.

Re: VPN Tunnel between static Palo Alto and dynamic Fortigate

furrygolden — Sat, 30 May 2015 14:35:30 GMT

Ok.. Got the tunnel up. However, traffic is only one way. I already checked my policies on both side, seems to be correct. Plus, these are the same policies that I used for both side static scenario that worked two ways. When I was troubleshooting the static scenario, I had the same issue and fixed it by rebooting the Fortigate and Palo Alto. However, this time reboot did not help.

Re: VPN Tunnel between static Palo Alto and dynamic Fortigate

pulukas — Sun, 31 May 2015 11:31:00 GMT

What do the logs say about the traffic that is not working?

Also be sure to have a a logging final deny rule so we can see if the traffic is hitting this rule.

Re: VPN Tunnel between static Palo Alto and dynamic Fortigate

santonic — Mon, 01 Jun 2015 06:34:00 GMT

It sounds like a routing issue in your case.

Don't think it matters in this case but in such scenarios I always set IKE gateway in passive mode.