05-30-2015 01:45 AM
What is the exact settings in order to establish a VPN tunnel between a Palo Alto firewall that has static WAN IP address and a Fortigate that has Dynamic WAN IP address?
If both has static IP address, the tunnel works.
If Fortigate has dynamic WAN address, I cannot get the VPN working. I tried aggressive mode on both sides. Palo Alto log keeps saying IKE phase-1 negotiation failed. Couldn't find configuration for IKE phase-1 request for peer IP X.X.X.X[500], ID ipaddr:X.X.X.X.
05-30-2015 06:27 AM
Check your gatway configurations. In addition to selecting aggressive mode on both sides. Your gateways need to be configured to use dynamic on one side and static on the other. And you should have local and peer identity configured. This is used as the alternative to knowing the static ip address to match the IKE phase 1. These are not necessrily real email address just matching strings in the form of email addresses, they need to be the same on both sides as a kind of "password" check.
05-30-2015 07:35 AM
Ok.. Got the tunnel up. However, traffic is only one way. I already checked my policies on both side, seems to be correct. Plus, these are the same policies that I used for both side static scenario that worked two ways. When I was troubleshooting the static scenario, I had the same issue and fixed it by rebooting the Fortigate and Palo Alto. However, this time reboot did not help.
05-31-2015 04:31 AM
What do the logs say about the traffic that is not working?
Also be sure to have a a logging final deny rule so we can see if the traffic is hitting this rule.
05-31-2015 11:34 PM
It sounds like a routing issue in your case.
Don't think it matters in this case but in such scenarios I always set IKE gateway in passive mode.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
