topic IPSEC GUI shows green for both phase 1 and 2 - Need to restart the ipsec to ping across the ipsec in General Topics

IPSEC GUI shows green for both phase 1 and 2 - Need to restart the ipsec to ping across the ipsec

MP18 — Wed, 01 May 2019 15:55:24 GMT

Gui shows both phase 1 and 2 up.

Can not ping lan IP at vendor end.

when i ping vendor lan ip

i see below

( description contains 'IKE phase-2 negotiation failed when processing proxy ID. cannot find matching phase-2 tunnel for received proxy ID. received local id: 0.0.0.0/0 type IPv4_subnet protocol 0 port 0, received remote id: 192.168.46.32/28 type IPv4_subnet protocol 0 port 0.' )

I need to restart the phase 2 from gui to make it work

Need to know why every time i need to retstart the phase 2 to make this work?

PA has this proxy is

Local 10.0.0.0/8

Remote 192.168.46.32/28

Re: IPSEC GUI shows green for both phase 1 and 2 - Need to restart the ipsec to ping across the ipse

Remo — Wed, 01 May 2019 18:30:02 GMT

Hi @MP18

Looks like the other end has configured the wrong proxy ID for your subnet. Instead of 10.0.0.0/8 they configured 0.0.0.0/0 or nothing is also possible and because of that they accept when you start the phase 2 tunnel but your firewall does not accept what the offer in the phase 2 negotiation.

Re: IPSEC GUI shows green for both phase 1 and 2 - Need to restart the ipsec to ping across the ipse

MP18 — Thu, 02 May 2019 01:49:08 GMT

You are spot on