Getting crazy with Ipsec-tunnel

[clinit_owner]

Hello everyone,

i'm trying a couple of days to establish an IPsec-tunnel to my amazon VPC with our PA-500.

I can do what ever i want the tunnel will not get up. The log file said:

2011-10-31 14:11:06 [DEBUG]: ikev1.c:1427:isakmp_ph1resend(): resend phase1 packet 3a1053711a202504:0000000000000000
2011-10-31 14:11:27 [PROTO_NOTIFY]: ikev1.c:2168:log_ph1negofailed(): ====> PHASE-1 NEGOTIATION FAILED AS INITIATOR, MAIN MODE <====
====> Failed SA: 82.xx.xx.xx[500]-87.xx.xx.xx[500] cookie:3a1053711a202504:0000000000000000 <==== Due to timeout.
2011-10-31 14:11:27 [INFO]: ikev1.c:2216:log_ph1deleted(): ====> PHASE-1 SA DELETED <====
====> Deleted SA: 82.xx.xx.xx[500]-87.xx.xx.xx[500] cookie:3a1053711a202504:0000000000000000i <====

Could anyone help me or send me a valid example configuration for Amazon VPC.

Thanks in Advance

[friento]

Checked if your security policy is blocking port 500.

[gswcowboy]

If you have an explicit deny rule in your rulebase, you will need an explicit allow rule for untrust zone to untrust zone for ike and ipsec application. Otherwise, to get more verbose details in your syslog, have the remote peer initiate the traffic as your current syslog output is not descriptive enough to give us insight to your issue. Otherwise, share your ike/ipsec crypto for both PAN and remote peer to get you more assistance

-Renato    

[clinit_owner]

the security policy is not blocking the port.

if i ping the ec2 instance the paloalto want to

establish the connecting, but always get the timeout failure.

Bad luck for me if nobody have a sample conf....

[friento]

I would revisit ike config as it looks like you are failing on p1. If all else fail open ticket to support, they can help you.

[gswcowboy]

It would behoove you to have the remote peer initiate the traffic so that you can get more precise information from the syslogs as to why phase 1 is failing. It's all about matching phase1/phase2 crypto maps and at this point, we don't have much to go on. Otherwise, please open a case with Support so we can provide further assistance.