VPN tunnel between ASA 5505 and PA 3020

[infotech]

I am trying to create a vpn tunnel betetween a ASA 5505 and PA 3020 and it keeps giving me IKEv2 error but I don't even have that enabled. What is the best way to do this type of VPN tunnel?

[HULK]

Hello Infotech,

Please find below doc, which might help you. By the way, IKE V2 currently it is not supported. However, there is a feature request previously submitted.  (FR ID: 1683). I would request you to set IKEv1 on your CISCO ASA to successfully build the VPN tunnel with PAN.

Sample IPSec Tunnel Configuration - Palo Alto Networks Firewall to Cisco ASA

IPSEC with Cisco ASA

Thanks

[infotech]

My ASA was never configured for IKEv2 I'm not sure why it is giving that error. Where do you set the nat 0?

[HULK]

Hello Infotech,

The ASA might be taking IKE version 2 by default. Could you please verify, if there is any option to disable it. The option would be available under Phase-1 configuration.

Thanks

[HULK]

FYI....

See Sample ASA Configuration on the mentioned link:

      Site-to-Site IKEv2 Tunnel between ASA and Router Configuration Examples - Cisco

     Book 3: Cisco ASA Series VPN CLI Configuration Guide, 9.1 - Configuring IPSec and ISAKMP [Cisco ASA ...

Thanks

[infotech]

I have confirmed that IKEv2 is not configured but it looks like it tries the ikev1 and it doesn't work.

[HULK]

Hello Infotech,

Could you please share SYSTEM logs from PAN FW here. It will give us some clue and point of failure.

Thanks

[infotech]

Sure how would you like to receive them?

[HULK · Accepted solution]

Thanks for your time Infotech,

At last, we identified as "No proposal chosen" for Phase-1 IKE.