topic iph1->ivm == NULL in General Topics

iph1->ivm == NULL

Ammar — Fri, 12 May 2017 12:57:36 GMT

Dears,

Since two days i am getting this message "iph1->ivm == NULL" and all VPN with ASA on the other side is facing iKE Phase 1 time out

Re: iph1->ivm == NULL

kiwi — Fri, 12 May 2017 14:19:17 GMT

Hi @Ammar,

I've seen this error in relation to the ASA sending the PEER ID as FQDN instead of IP.

See if the following DOC can help you :

https://live.paloaltonetworks.com/t5/Configuration-Articles/VPN-Tunnel-Down-Between-Palo-Alto-Networks-Firewall-Static-IP/ta-p/58050

Cheers !

-Kiwi.

Re: iph1->ivm == NULL

Ammar — Fri, 12 May 2017 14:23:37 GMT

so if that is the case, how can i solve the issue ???

Re: iph1->ivm == NULL

kiwi — Fri, 12 May 2017 14:41:34 GMT

Hi @Ammar,

Check the crypto settings on the ASA side and confirm if it is configured with FQDN or IP (and change it if you can).

Alternatively, as a workaround you can configure both VPN peers in aggressive mode which might also help.

Note that the info provided is rather slim and I'm basing my answer on the error message you added.

In relation the me having seen this error before, it came together with the following error (which is a clear give-away of the issue):

iph1->ivm == NULL

IKE phase-1 negotiation is failed. Peer's ID payload <some.domain.com>(type fqdn) does not match a configured IKE gateway

Cheers,

-Kiwi

Re: iph1->ivm == NULL

Ammar — Fri, 12 May 2017 14:47:58 GMT

Hi @kiwi

i think in my case it is different.

i'm geeting this error anlng with a timeout in IKE Phase 1 (however peers are communicating perfectly)

Re: iph1->ivm == NULL

kiwi — Fri, 12 May 2017 14:55:56 GMT

Hi @Ammar

My example also returned a timeout in IKE-Ph1 :

IKE phase-1 SA is deleted SA: X.X.X.X[500]-X.X.X.X[500] cookie:54ec63e98d074d27:0000000000000000.
04/04 17:09:30
IKE phase-1 negotiation is failed as initiator, aggressive mode. Failed SA: X.X.X.X[500]-X.X.X.X[500] cookie:54ec63e98d074d27:0000000000000000. Due to timeout.
04/04 17:09:30
iph1->ivm == NULL
04/04 17:09:10
IKE phase-1 negotiation is failed. Peer's ID payload <some.domain.com> (type fqdn) does not match a configured IKE gateway.

Cheers,

-Kiwi