IPSec S2S VPN between Palo Alto and Sophos XG

Isaac_Zheng — Thu, 22 Oct 2020 02:41:30 GMT

Hi,

I'm trying to set up a S2S between Palo Alto Sophos XG and so far it's been unsuccessful as Palo Alto is not able to find a suitable proposal for the connection.

I've also tried the following the KB here. (https://www.sophos.com/en-us/medialibrary/PDFs/documentation/SophosFirewall/Pocket-Guides/Establish-IPsec-VPN-Connection-between-Sophos-and-PaloAlto.pdf)

I'm supposed to be using IKEv1, AES256-SHA256, DH5 and I've checked to make sure the settings on both Firewalls are aligned (IKE, encryption keys, preshared keys).

Below is the logs from Palo Alto for a connection coming in from Sophos. Any insight to interpreting the logs would be helpful.

2020-10-21 01:29:05.195 +0000 [PNTF]: { 54: }: ====> PHASE-1 NEGOTIATION STARTED AS RESPONDER, MAIN MODE <====
====> Initiated SA <====
[INFO]: { 54: }: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt
[INFO]: { 54: }: received Vendor ID: DPD
[INFO]: { 54: }: received Vendor ID: CISCO-UNITY
[INFO]: { 54: }: received Vendor ID: FRAGMENTATION
[INFO]: { 54: }: received Vendor ID: RFC 3947
[INFO]: { 54: }: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02

[PERR]: { 54: }: rejected hashtype: DB(prop#1:trns#1):Peer(prop#0:trns#1) = SHA1:SHA256
[PERR]: { 54: }: rejected dh_group: DB(prop#1:trns#1):Peer(prop#0:trns#1) = DH2:DH5
[PERR]: { 54: }: rejected enctype: DB(prop#1:trns#2):Peer(prop#0:trns#1) = 3DES:AES
[PERR]: { 54: }: rejected hashtype: DB(prop#1:trns#2):Peer(prop#0:trns#1) = SHA1:SHA256
[PERR]: { 54: }: rejected dh_group: DB(prop#1:trns#2):Peer(prop#0:trns#1) = DH2:DH5
[PERR]: { 54: }: rejected hashtype: DB(prop#1:trns#1):Peer(prop#0:trns#2) = SHA1:SHA256
[PERR]: { 54: }: rejected enctype: DB(prop#1:trns#2):Peer(prop#0:trns#2) = 3DES:AES
[PERR]: { 54: }: rejected hashtype: DB(prop#1:trns#2):Peer(prop#0:trns#2) = SHA1:SHA256
[PERR]: { 54: }: rejected hashtype: DB(prop#1:trns#1):Peer(prop#0:trns#3) = SHA1:SHA256
[PERR]: { 54: }: rejected dh_group: DB(prop#1:trns#1):Peer(prop#0:trns#3) = DH2:DH19
[PERR]: { 54: }: rejected enctype: DB(prop#1:trns#2):Peer(prop#0:trns#3) = 3DES:AES
[PERR]: { 54: }: rejected hashtype: DB(prop#1:trns#2):Peer(prop#0:trns#3) = SHA1:SHA256
[PERR]: { 54: }: rejected dh_group: DB(prop#1:trns#2):Peer(prop#0:trns#3) = DH2:DH19
[PERR]: { 54: }: rejected enctype: DB(prop#1:trns#1):Peer(prop#0:trns#4) = AES:TBD
[PERR]: { 54: }: rejected hashtype: DB(prop#1:trns#1):Peer(prop#0:trns#4) = SHA1:TBD
[PERR]: { 54: }: rejected dh_group: DB(prop#1:trns#1):Peer(prop#0:trns#4) = DH2:DH19
[PERR]: { 54: }: rejected enctype: DB(prop#1:trns#2):Peer(prop#0:trns#4) = 3DES:TBD
[PERR]: { 54: }: rejected hashtype: DB(prop#1:trns#2):Peer(prop#0:trns#4) = SHA1:TBD
[PERR]: { 54: }: rejected dh_group: DB(prop#1:trns#2):Peer(prop#0:trns#4) = DH2:DH19
[PERR]: { 54: }: no suitable proposal found.

[PERR]: { 54: }: (nil) failed to get valid proposal.
[PERR]: { 54: }: failed to process packet.
[INFO]: { 54: }: ====> PHASE-1 SA DELETED <====
====> Deleted SA <====

Re: IPSec S2S VPN between Palo Alto and Sophos XG

reaper — Thu, 22 Oct 2020 09:26:28 GMT

is there a way for you to limit the proposals the Sophos is sending out, and could you post which config you have set on the PAN?

the log shows AES but no keysize, so maybe it's proposing 128 instead of 256

topic Re: IPSec S2S VPN between Palo Alto and Sophos XG in General Topics

IPSec S2S VPN between Palo Alto and Sophos XG

Re: IPSec S2S VPN between Palo Alto and Sophos XG