topic Re: Always get "likely" pre-shared key mismatch in General Topics

Always get "likely" pre-shared key mismatch

Amnuay — Mon, 13 Jan 2014 02:44:38 GMT

I tried to configure Site-to-site VPN from PAN 5.0.5 to Juniper Netscreen OS.

Even I type very according easy pre-shared key. On PAN it always shown

"IKE phase-1 negotiation is failed likely due to pre-shared key mismatch"

Anyone have any suggestion?

Thank you.

Re: Always get "likely" pre-shared key mismatch

HULK — Mon, 13 Jan 2014 07:23:40 GMT

Hello Sir,

Could you please re-enter the pre-shared key on the other end device also. Also try below mentioned steps:

1. Clear any discard-state session for S-port=500 and d-port=500 with the help of CLI command

> clear session all filter state discard source-port 500 destination-port 500

If this is the only VPN tunnel configured on this PAN firewall, then also try:

> clear session all filter source-port 500 destination-port 500

2. Try to make the PAN firewall as a responder for VPN and test.

Thanks

Re: Always get "likely" pre-shared key mismatch

Amnuay — Mon, 13 Jan 2014 11:03:35 GMT

Hi HULK,

Thanks for your reply ^^ I've tried your suggestion but still no luck. I try to examine the hash of pre-shared key no both side but I think it will not help (Just in case it stored with the same hash but it turn out different but I don't doubt that)

Here's what I got on ScreenOS.

2014-01-13 17:36:27 info IKE "PAN-IP" phase 1:The symmetric crypto key has been generated successfully.

2014-01-13 17:36:27 info IKE"ScreenOS-IP" "PAN-IP" Phase 1: Initiated negotiations in main mode.

2014-01-13 17:36:15 info IKE "PAN-IP" Phase 1: Retransmission limit has been reached.

2014-01-13 17:35:27 info IKE "PAN-IP" phase 1:The symmetric crypto key has been generated successfully.

2014-01-13 17:35:27 info IKE"ScreenOS-IP" "PAN-IP" Phase 1: Initiated negotiations in main mode.

2014-01-13 17:35:15 info IKE "PAN-IP" Phase 1: Retransmission limit has been reached.

2014-01-13 17:34:27 info IKE "PAN-IP" phase 1:The symmetric crypto key has been generated successfully.

2014-01-13 17:34:27 info IKE"ScreenOS-IP" "PAN-IP" Phase 1: Initiated negotiations in main mode.

and here from PAN-OS 5.0.5

1 13-01-14 17:46 9401000816 SYSTEM vpn 0 13-01-14 17:46 ike-nego-p1-delete Office_VPNGW 0 0 general informational IKE phase-1 SA is deleted SA: "PAN-IP"[500]-"ScreenOS-IP"[500] cookie:55d138c5d3a1bffd:4b28a9d9c57d8fbd. 64352 0x0

1 13-01-14 17:46 9401000816 SYSTEM vpn 0 13-01-14 17:46 ike-nego-p1-fail Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed as responder, main mode. Failed SA: "PAN-IP"[500]-"ScreenOS-IP"[500] cookie:55d138c5d3a1bffd:4b28a9d9c57d8fbd. Due to timeout. 64351 0x0

1 13-01-14 17:45 9401000816 SYSTEM vpn 0 13-01-14 17:45 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64350 0x0

1 13-01-14 17:45 9401000816 SYSTEM vpn 0 13-01-14 17:45 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64349 0x0

1 13-01-14 17:45 9401000816 SYSTEM vpn 0 13-01-14 17:45 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64348 0x0

1 13-01-14 17:45 9401000816 SYSTEM vpn 0 13-01-14 17:45 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64347 0x0

1 13-01-14 17:45 9401000816 SYSTEM vpn 0 13-01-14 17:45 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64346 0x0

1 13-01-14 17:45 9401000816 SYSTEM vpn 0 13-01-14 17:45 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64345 0x0

1 13-01-14 17:45 9401000816 SYSTEM vpn 0 13-01-14 17:45 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64344 0x0

1 13-01-14 17:45 9401000816 SYSTEM vpn 0 13-01-14 17:45 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64343 0x0

1 13-01-14 17:45 9401000816 SYSTEM vpn 0 13-01-14 17:45 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64342 0x0

1 13-01-14 17:45 9401000816 SYSTEM vpn 0 13-01-14 17:45 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64341 0x0

1 13-01-14 17:45 9401000816 SYSTEM vpn 0 13-01-14 17:45 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64340 0x0

1 13-01-14 17:45 9401000816 SYSTEM vpn 0 13-01-14 17:45 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64339 0x0

1 13-01-14 17:45 9401000816 SYSTEM vpn 0 13-01-14 17:45 ike-nego-p1-start Office_VPNGW 0 0 general informational IKE phase-1 negotiation is started as responder, main mode. Initiated SA: "PAN-IP"[500]-"ScreenOS-IP"[500] cookie:55d138c5d3a1bffd:4b28a9d9c57d8fbd. 64338 0x0

1 13-01-14 17:45 9401000816 SYSTEM vpn 0 13-01-14 17:45 ike-nego-p1-delete Office_VPNGW 0 0 general informational IKE phase-1 SA is deleted SA: "PAN-IP"[500]-"ScreenOS-IP"[500] cookie:b8cfe8c9f96e4225:b688c89484088d3c. 64337 0x0

1 13-01-14 17:45 9401000816 SYSTEM vpn 0 13-01-14 17:45 ike-nego-p1-fail Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed as responder, main mode. Failed SA: "PAN-IP"[500]-"ScreenOS-IP"[500] cookie:b8cfe8c9f96e4225:b688c89484088d3c. Due to timeout. 64336 0x0

1 13-01-14 17:44 9401000816 SYSTEM vpn 0 13-01-14 17:44 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64335 0x0

1 13-01-14 17:44 9401000816 SYSTEM vpn 0 13-01-14 17:44 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64334 0x0

1 13-01-14 17:44 9401000816 SYSTEM vpn 0 13-01-14 17:44 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64333 0x0

1 13-01-14 17:44 9401000816 SYSTEM vpn 0 13-01-14 17:44 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64332 0x0

1 13-01-14 17:44 9401000816 SYSTEM vpn 0 13-01-14 17:44 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64331 0x0

1 13-01-14 17:44 9401000816 SYSTEM vpn 0 13-01-14 17:44 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64330 0x0

1 13-01-14 17:44 9401000816 SYSTEM vpn 0 13-01-14 17:44 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64329 0x0

1 13-01-14 17:44 9401000816 SYSTEM vpn 0 13-01-14 17:44 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64328 0x0

1 13-01-14 17:44 9401000816 SYSTEM vpn 0 13-01-14 17:44 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64327 0x0

1 13-01-14 17:44 9401000816 SYSTEM vpn 0 13-01-14 17:44 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64326 0x0

1 13-01-14 17:44 9401000816 SYSTEM vpn 0 13-01-14 17:44 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64325 0x0

1 13-01-14 17:44 9401000816 SYSTEM vpn 0 13-01-14 17:44 ike-nego-p1-fail-psk Office_VPNGW 0 0 general informational IKE phase-1 negotiation is failed likely due to pre-shared key mismatch. 64324 0x0

1 13-01-14 17:44 9401000816 SYSTEM vpn 0 13-01-14 17:44 ike-nego-p1-start Office_VPNGW 0 0 general informational IKE phase-1 negotiation is started as responder, main mode. Initiated SA: "PAN-IP"[500]-"ScreenOS-IP"[500] cookie:b8cfe8c9f96e4225:b688c89484088d3c. 64323 0x0

T^T

Re: Always get "likely" pre-shared key mismatch

HULK — Mon, 13 Jan 2014 15:39:44 GMT

Hello Sir,

Thanks for your update and could you please go through the knowledge base article IKE Phase-1 Negotiation is Failed as Responder and verify all settings again.

It is not possible to ping from the VPN gateway IP of the PAN to the VPN gateway IP of the firewall at the other end of the tunnel.
It is possible to ping from the PAN to the VPN gateway IP of the other firewall if a source IP (PAN VPN gateway IP) is not specified.
The IPSec VPN is working correctly.
VPN configuration is correct on both firewalls.
Security policy configuration is correct on both firewalls.

Resolution

Check the routing table of devices between the firewalls. A route table entry may need to be added or removed to provide proper network connectivity.

Thanks

Re: Re: Always get "likely" pre-shared key mismatch

Amnuay — Tue, 14 Jan 2014 10:30:34 GMT

Hi HULK,

^^ here what I've seen.

It is not possible to ping from the VPN gateway IP of the PAN to the VPN gateway IP of the firewall at the other end of the tunnel.

[AM] Yes this from PAN cannot ping to another VPN gateway because it was not allow on PAN. But after allow it still have same problem.

It is possible to ping from the PAN to the VPN gateway IP of the other firewall if a source IP (PAN VPN gateway IP) is not specified.

[AM] Nah, After policy to allow traffic was added. either specify or not specify source IP ping is success.

The IPSec VPN is working correctly.

[AM] the VPN never came up since it "likly" mismatch -_-"

VPN configuration is correct on both firewalls.

[AM] Yes I think so. Just PAN that newly established but the same configuration as others.

Security policy configuration is correct on both firewalls.

[AM] Yes all required IPSec traffic has been allow.

I am really doubt in pre-shared key likly not match how come this happen and anyway to do deep diagnostic?

Again I type and retype start from general complexity 20 char with symbol and number like other firewall brands but not success and I move down a little but now its very simple 15 char only still "likely" not match T^T

Re: Always get "likely" pre-shared key mismatch

HULK — Tue, 14 Jan 2014 15:01:41 GMT

Hello Sir,

I would request you to open a case with PAN support for this issue and pls share the case ID here.

Thanks

Re: Always get "likely" pre-shared key mismatch

Amnuay — Fri, 17 Jan 2014 03:19:38 GMT

Hi HULK,

Thank you for your help. I'm now able to solve this. It was compatibility issue. I've discovered that on Juniper stated SHA2-256 but on PAN stated sha256 -> I expect this give the same result but not.

So fallback to SHA1 is my solution to this event.

More fix for PAN -> I expect better error message not just "likely" LoL ^^

to HULK Thank a lot.