IPSEC Phase-1 fails as initiator but not as responder

Reply
Highlighted
L3 Networker

IPSEC Phase-1 fails as initiator but not as responder

Hello support community,
I'm using a PAN 3020 A/P cluster on the perimeter running 6.0.9.  At all of my remote sites I have a cisco ASA that uses IPSEC tunnels to connect back to the main network.  The IPSEC tunnel configuration (IKE phase 1, IKE phase 2, and peer IDs) are consistent across my remote sites (best to my knowledge).  Out of my 8 IPSEC tunnels, when I try to initiate the tunnel to one site I receive the following in the system logs where X is the remote peer and Y is the local peer: "received unencrypted Notify payload (NO-PROPOSAL-CHOSEN) from IP X.X.X.X[500] to Y.Y.Y.Y[500], ignored."  I then get: "IKE phase-1 negotiation is failed as initiator, main mode. Failed SA: Y.Y.Y.Y[500]-72.28.162.32[500] cookie:cbf02ee495115ae1:0000000000000000. Due to timeout.'

If the PAN is the responder, the tunnel comes up: "IKE phase-1 negotiation is succeeded as responder, main mode. Established SA: Y.Y.Y.Y[500]-X.X.X.X[20796] cookie:2790c31cdce7deae:05a5f962eee2989b lifetime 86400 Sec."

Looking at the interpret-vpn-error-messages.html page, I would think if there was a proposal mismatch in the IKE Crypto profile, it would fail as both initiator and responder. I've verified the isakmp policy on the cisco side matches what's configured in the IKE Crypto policy, and I've verified the firewall is allowing the traffic via security policy.

Any ideas why I'm failing as an initiator?

Highlighted
L4 Transporter

Hi Dan,


IPSec Interoperability Between Palo Alto Firewalls and Cisco ASA


Please find the below link for the Ipsec VPN configuration :-

https://live.paloaltonetworks.com/docs/DOC-2579

https://live.paloaltonetworks.com/docs/DOC-6791

Kindly let us know if  any further support is required.

Regards

Satish

Highlighted
L7 Applicator

Since you know the actual crypto settings are correct, I would suspect one of these:

There is some kind of firewall blocking your request as initiator to the ASA interface.  But as a responder you match the session created by the ASA so it works.

The Cisco configuration has the initiator only command in the configuration so it will not respond.

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!