topic Re: 'unknown ikev2 peer - Azure in General Topics

'unknown ikev2 peer - Azure

Sistemas_SanLucar — Thu, 09 Jan 2020 13:27:50 GMT

Hi,

I have several Azure sites with an active-active gateway and 2 different ip.
I have a Palo Alto pa-820 with 8.1.12 firmware, 2 interfaces with 2 different communication providers and different public ip.
What makes a tunnel ikev2, bgp and peers.

Scheme:

pa-820-Supplier1-IP1---- IP1-AzureGW1
pa-820-Supplier2-IP2----IP2-AzureGW1

In Azure I have configured a vnet (x.x.0.0/16) and in this vnet I have 2 subnets (gateway x.x.255.224/27 and servers x.x.60.0/24)

I create in the tunnel the corresponding proxy-id:

subnet_local1_x.x.255.224/27
subnet_local2 x.x.255.224/27
...
subnet_local1 x.x.60.0/24
subnet_local2 x.x.60.0/24
...

This error appears repeatedly in the system log:

eventid: ike-generic-event

description: 'unknown ikev2 peer'

subtype: vpn

severity: informational

If I execute command "tail follow yes mp-log ikemgr.log" its shows:

020-01-09 14:13:07.113 +0100 [PWRN]: x.x.x.x[500] - z.z.z.z[500]:0x10343ab0 unknown ikev2 peer
2020-01-09 14:13:08.099 +0100 [PWRN]: x.x.x.x[500] - t.t.t.t[500]:0x10345950 unknown ikev2 peer

The tunnel's working. But I don't know why it indicates this error.

Can you help me?

thanks

Re: 'unknown ikev2 peer - Azure

Sistemas_SanLucar — Thu, 09 Jan 2020 13:39:38 GMT

Re: 'unknown ikev2 peer - Azure

Herwan — Tue, 14 Jan 2020 01:58:24 GMT

i have the same issue here where IKE is connected but IPSEC is not when connecting to Azure. received a lot of error with " unknwon ikev2 peer"

Re: 'unknown ikev2 peer - Azure

Sistemas_SanLucar — Wed, 05 Feb 2020 09:30:55 GMT

We've already figured out the problem. We have in Azure a GW configured as active/active with 2 IPs. In our part we have 2 APs configured in active/passive but with 2 public IPs from 2 different operators.

Operator 1 -tunnel - IP1 Azure
Operator 2 -tunnel - IP2 Azure.

It turns out that Azure tries to connect IP2 with Operator1 and IP1 with Operator2. This is the normal operation of Azure.

Because I only have a virtual routing I can not perform these tunnels.