topic Re: Query on DH group for IPSEC VPN in General Topics

Query on DH group for IPSEC VPN

FarzanaMustafa — Tue, 02 Jun 2020 00:26:23 GMT

We are having issue in building an IPSEC tunnel on a Palo firewall. Using ver 9.1.2.

Getting below error

'IKE phase-1 negotiation is failed. Couldn't find configuration for IKE phase-1 request for peer IP...

The peer IP type is Dynamic with no proxy ID in use. We are using IKEv1, DPD is disabled, NAT-t is enabled, Phase1 & 2 are matching at both ends, Exchange modes are also matching. PA is enabled in passive mode.

We had to set DH Group to no-pfs under IPsec crypto profile.

When setting no-pfs value is there any other setting we need to set on palo side for the tunnel to work?

Re: Query on DH group for IPSEC VPN

OtakarKlier — Wed, 03 Jun 2020 21:30:53 GMT

Hello,

The phase 1 properties are not correct for both sides of the tunnel. The 'receiving' side of the VPN should provide more information as to why. However start with the basics and make sure your ike settings are identical on both devices.

Also check your logs to make sure you are not dropping any of the traffic (doesnt sound like it however).

Regards,