topic Re: Proxy-ID Error message for GlobalProtect Client in General Topics

Proxy-ID Error message for GlobalProtect Client

Don_Russell — Tue, 08 Aug 2017 18:06:31 GMT

We have configured a GlobalProtect Gateway to service clients using both the GP Agent and X-Auth parameters with 3rd Party Clients.

We have been receiving the following error messages:

'IKE phase-2 negotiation failed when processing proxy ID. cannot find matching phase-2 tunnel for received proxy ID. received local id: 10.0.0.0/8 type IPv4_subnet protocol 0 port 0, received remote id: 10.10.2.5/32 type IPv4_address protocol 0 port 0.'

The Object shown in the error messages identifies the name of our GlobalProtect Gateway.

I am surprised to find Phase-2 Proxy-ID error messsages associated with a GP Gateway. Any thoughts on what might be the cause of this?

Re: Proxy-ID Error message for GlobalProtect Client

Remo — Tue, 08 Aug 2017 19:12:59 GMT

Hi @Don_Russell

Behind the scenes global protect is nothing else than a standard IKE/IPSec tunnel (with additional features).

What routes did you configure in your global protect gateway settings? Is 10.0.0.0/8 configured? And also does the client IP match the IP pool you have configured? If not, then it looks like a third party client has changed the settings manually on the local client and so does not accept the settings from your gateway.

Re: Proxy-ID Error message for GlobalProtect Client

Don_Russell — Wed, 16 Aug 2017 13:50:53 GMT

Thank you, @Remo! That was what I needed to know. I greatly appreciate the help!