- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
03-16-2015 11:29 PM
Hello All,
We would like to know whether the Fortigate Cloud Firewall running on FortiOS Version 5 is supported by PA for IPsec VPN as we are getting below error and tunnel is not coming up.
2015-03-17 10:53:28 [DEBUG]: vendorid.c:274:check_vendorid(): received unknown Vendor ID à Other End device is a Fortigate Cloud Firewall running on FortiOS Version 5. Is this supported by Palo Alto ?
2015-03-17 10:53:28 [DEBUG]: ipsec_doi.c:283:get_ph1approval(): an acceptable proposal found.
2015-03-17 10:53:28 [DEBUG]: ikev1.c:1672:isakmp_ph1resend(): resend phase1 packet 24871bfed0152c7e:faab2d4faea77d3f
2015-03-17 10:53:34 [INFO]: ikev1.c:318:ikev1_main(): the packet is retransmitted by 40.132.56.196[500]
2015-03-17 10:53:46 [DEBUG]: ikev1.c:1672:isakmp_ph1resend(): resend phase1 packet 24871bfed0152c7e:faab2d4faea77d3f
2015-03-17 10:53:49 [PROTO_NOTIFY]: ikev1.c:2423:log_ph1negofailed(): ====> PHASE-1 NEGOTIATION FAILED AS RESPONDER, MAIN MODE <====
====> Failed SA: 117.239.143.210[500]-40.132.56.196[500] cookie:0f9f6a98fdcb36ec:807e1f8d23119dee <==== Due to timeout.
2015-03-17 10:53:49 [INFO]: ikev1.c:2471:log_ph1deleted(): ====> PHASE-1 SA DELETED <====
====> Deleted SA: 117.239.143.210[500]-40.132.56.196[500] cookie:0f9f6a98fdcb36ec:807e1f8d23119dee <====
Thanks.
03-17-2015 11:54 AM
Hello TAC,
Error "received unknown Vendor ID" doesn't mean peer is not supported for VPN, it appears to be a different issue.
I would suggest to open a case with TAC.
Regards,
Hardik Shah
03-17-2015 01:10 PM
Based on the logs here you should check these two settings.
Preshared key: confirm this is the same on both devices
Phase one crypto packages: confirm these are the same on both devices
These are configured on the Palo Alto at
Network tab -- Network profiles-- IKE Gateway
The crypto options are created
Network tab--Network profiles--IKE Crypto
The default Cryto package settings are
Group 2; AES or 3DES; SHA1 and 8 hours lifetime
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!