IKE-NEGO-P1-FAIL

[FarzanaMustafa]

We are trying to setup a IPSec VPN from our VM-300 Palo Alto Firewall running in AWS. Using PANOS 9.0.11.

I’m having issues with the configuration of the IKE Gateway as the Interface IP address is set via AWS DHCP and does not reflect the public (elastic) IP. 

PAN OS will not allow me to set an address in the Local IP address field the only option allowed is 'none'.

The address for the interface is set by DHCP (VIA AWS) and my guess is that this is why the PAN won’t let me set the local IP value for the gateway.

I tried using the local and peer identification fields

The system logs show: 

[SebRupik · Accepted solution]

Hi there,

In AWS why don't you create an ENI and specify a private IP address, then assign this ENI to Eth1/1 on your palo alto. You can then statically assign the IP address under Network -> Interfaces -> Eth1/1. This will allow you to select  it in the IKE Gateway setup.

cheers,

Seb.

[BPry]

@FarzanaMustafa,

@SebRupik gave you the best answer. You could also just spin up the AWS side like you would any other DHCP peer and use one of the other identification methods available to you outside of IP Address like FQDN, KEYID, or Email Address. You don't absolutely need to utilize the IP address for Identification, even though that's the most secure option if available.