03-31-2015 06:08 PM
Hello support community,
I'm using a PAN 3020 A/P cluster on the perimeter running 6.0.9. At all of my remote sites I have a cisco ASA that uses IPSEC tunnels to connect back to the main network. The IPSEC tunnel configuration (IKE phase 1, IKE phase 2, and peer IDs) are consistent across my remote sites (best to my knowledge). Out of my 8 IPSEC tunnels, when I try to initiate the tunnel to one site I receive the following in the system logs where X is the remote peer and Y is the local peer: "received unencrypted Notify payload (NO-PROPOSAL-CHOSEN) from IP X.X.X.X to Y.Y.Y.Y, ignored." I then get: "IKE phase-1 negotiation is failed as initiator, main mode. Failed SA: Y.Y.Y.Y-126.96.36.199 cookie:cbf02ee495115ae1:0000000000000000. Due to timeout.'
If the PAN is the responder, the tunnel comes up: "IKE phase-1 negotiation is succeeded as responder, main mode. Established SA: Y.Y.Y.Y-X.X.X.X cookie:2790c31cdce7deae:05a5f962eee2989b lifetime 86400 Sec."
Looking at the interpret-vpn-error-messages.html page, I would think if there was a proposal mismatch in the IKE Crypto profile, it would fail as both initiator and responder. I've verified the isakmp policy on the cisco side matches what's configured in the IKE Crypto policy, and I've verified the firewall is allowing the traffic via security policy.
Any ideas why I'm failing as an initiator?
03-31-2015 10:00 PM
IPSec Interoperability Between Palo Alto Firewalls and Cisco ASA
Please find the below link for the Ipsec VPN configuration :-
Kindly let us know if any further support is required.
04-01-2015 03:14 AM
Since you know the actual crypto settings are correct, I would suspect one of these:
There is some kind of firewall blocking your request as initiator to the ASA interface. But as a responder you match the session created by the ASA so it works.
The Cisco configuration has the initiator only command in the configuration so it will not respond.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!