IPSec VPN with Cisco ASA behind NAT

arnljot — Mon, 09 Sep 2013 11:09:22 GMT

I'm trying to establish a ipsec VPN tunnel with a Cisco ASA with a peer address behind a NAT fw. We have checked all ike and ipsec crypto parameters, and successfully established vpn with Cisco ASA before.

Phase 1 is failing due to time out, and we get a log entry that indicate that the private peer address (which is behind NAT) is "visiblie" to the PAN local peer.

Black strike out is the local gw ip public address, and red is the public peer (NAT) ip

The address in the top event is the private GW address that is behind NAT. I did not expect the PAN box on our side to see this address.

NAT Traversal is on, on both sides.

This is how Phase-1 times out with the following log entries (never mind the time stamp, I did not clip the corresponding log entries)

I have monitored the mp-log/ikemgr.log with debug on, but get no hints as to why this is failing.

Appreciate any help resolving this issue

Re: IPSec VPN with Cisco ASA behind NAT

UhMayYeah — Mon, 09 Sep 2013 12:19:16 GMT

Can you try to set

Local ID on ASA =Public IP of the NAT device &&

Peer Identification on PA firewall = Public IP of the NAT device under ike-gateway on PA.

Re: IPSec VPN with Cisco ASA behind NAT

arnljot — Thu, 11 Jun 2015 16:43:39 GMT

This was a bug in PANOS. Probably some memory leak. A reboot solved the issue, and I believe this problem has been solved in a later release.

topic IPSec VPN with Cisco ASA behind NAT in General Topics

IPSec VPN with Cisco ASA behind NAT

Re: IPSec VPN with Cisco ASA behind NAT

Re: IPSec VPN with Cisco ASA behind NAT