topic Re: Site-to-Site VPN with Dynamic Peer IP address not forming in General Topics

Site-to-Site VPN with Dynamic Peer IP address not forming

Bocsa — Sun, 15 Nov 2015 18:32:02 GMT

In this set up, I'm trying to configure a site-to-site VPN between a PA and a Cisco 3G router (whose IP address will be dynamic). I'm unable to get the tunnel working. When I run the command 'show vpn ike-sa gateway <gatewayname>', I get no information about the tunnel. It doesn't even seem to know about the tunnel.

Any ideas please?

Re: Site-to-Site VPN with Dynamic Peer IP address not forming

Raido_Rattameister — Sun, 15 Nov 2015 21:53:39 GMT

Initiate traffic towards Palo.

Go to system log.

What error do you see there?

Re: Site-to-Site VPN with Dynamic Peer IP address not forming

Bocsa — Mon, 16 Nov 2015 10:36:41 GMT

Hi,

I've tried initiating traffic to the Palo. In the system logs, I get: 'IKE phase-1 negotiation is failed. Couldn't find configuration for IKE phase-1 request for peer IP '

I've not configured a static peer IP as this is a 3G router so I'm not sure of what the problem here would be

Re: Site-to-Site VPN with Dynamic Peer IP address not forming

santonic — Mon, 16 Nov 2015 11:23:59 GMT

I think your problem is ID for phase 1 for remote peer. Instead of IP address being used as ID select for example User FQDN as peer identification, then configure same settings on Cisco as well. I also set PA in such case to be in 'passive mode' as it cannot be initiator anyway (as the remote peer has dynamic IP).

Re: Site-to-Site VPN with Dynamic Peer IP address not forming

Bocsa — Mon, 16 Nov 2015 12:39:39 GMT

Hi Santonic,

Thanks for your contribution. As it is a 3G router, can a User FQDN be configured? And what would it resolve to?

Re: Site-to-Site VPN with Dynamic Peer IP address not forming

santonic — Mon, 16 Nov 2015 13:30:59 GMT

Don't know anything about the router you have there. You have to check what it supports as IPSec ID.

User FQDN can be an email address. Basicaly it doesn't check anything, just the strings on both sides have to match. So think of it as a second password of sorts.

Re: Site-to-Site VPN with Dynamic Peer IP address not forming

Bocsa — Wed, 25 Nov 2015 09:24:33 GMT

I have now been able to get Phase 1 of the VPN working. Instead of using a Policy-based VPN, i have configured a Route-based VPN using Tunnel interfaces at both sides.

I am still having a problem with Phase 2. I get the below error when pinging from one side to the other:

'IKE phase-2 negotiation failed when processing proxy ID. cannot find matching phase-2 tunnel for received proxy ID'

I've defined the address ranges I expect to communicate between both sides in the Proxy ID but still get this error.

Any thoughts anyone?

Re: Site-to-Site VPN with Dynamic Peer IP address not forming

Raido_Rattameister — Wed, 25 Nov 2015 10:09:14 GMT

Is this full error you get?

Proxy id error in system log should tell exactly what other end sends.

So you can configure your Phase 2 accordingly.

Can you paste full proxy id error here?