topic Re: IPSec VPN issue in General Topics

IPSec VPN issue

Javith — Wed, 14 Oct 2015 11:02:56 GMT

Hi All,

We have configured IPSec VPN between PAN and AWS.

When i iniate the tunnel, IPSec and IKE SA installed successfully as a initiator.

then, IKE protocol IPSec SA delete message sent to peer. SPI:0x...

After a second, IPSec key deleted. Deleted SA..... please suggest

Re: IPSec VPN issue

santonic — Wed, 14 Oct 2015 11:27:56 GMT

Soundslike some reachibility test fails. Check if you are dropping something towards AWS peers.

Re: IPSec VPN issue

pankaku — Wed, 14 Oct 2015 12:21:32 GMT

Does the phase one is comming up? If yes then the issue with proxy ID.

Have you opened the udp port 500 and udp 4500 on the AWS?

Are you able to ping the public IP address?

Re: IPSec VPN issue

Raido_Rattameister — Wed, 14 Oct 2015 13:49:07 GMT

Can you set vpn on Palo into passive mode and initiate vpn from other side?

System log on Palo shows pretty exactly at what state vpn fails.

Re: IPSec VPN issue

OtakarKlier — Wed, 14 Oct 2015 15:46:03 GMT

The only options are Main, Auto, and Agressive. You can play with those. But like pakumar pointed out. If its phase 2, it could be proxy id's.

Its under Ike Gateway -> Advanced Phase 1 options.

Re: IPSec VPN issue

OtakarKlier — Wed, 14 Oct 2015 15:52:03 GMT

Of course i didnt look very hard, Yes there is a Passive option in the IKE gateway.

Re: IPSec VPN issue

santonic — Thu, 15 Oct 2015 07:42:25 GMT

According to original post (Quote:"When i iniate the tunnel, IPSec and IKE SA installed successfully as a initiator.") I'd say all parameters are ok and IPSEC is esatblished sucesfully but DPD mechanism kicks in and takes it down.