Ipsec proxy Tunnel issue with multiple tunnels

[Venkatesan_radhakrishnan]

HI Team,

I have configure Ipsec between PA and Cisco ASA, IPSEC is up but not traffic is passing. 

During the troubleshooting I have found for the proxy ID's configure in palo alto for some of the proxy id's only encapulation packet paloalto is sending and there is no decapusulation packet increasing for the proxy tunnel.

But in the same Ipsec tunnel other proxy ID's are working fine. My firewall is running 8.0.13 which is recommened by Palo alto.

Replay protection is already disabled, Phase 1 is having 24 hours and Phase 2 has 1 hour life time.

I'm not seeing issue in negotiation, The proxy tunnel which is having issue is in the init state in PA side when analysing through command show vpn ikesa gateway  gatewayname.

Please suggest what can be done further to check this issue.

Regards

Venky

[Venkatesan_radhakrishnan]

HI Guys,

Do anyone able to get my issue

[aleksandar.astardzhiev]

Hi @Venkatesan_radhakrishnan,

If you can see statistics for encrypted packets, this means that the IPsec SA for the problematic proxy ids are successfully negotiated and Palo Alto firewall is actually sending traffic through the tunnel.

So I would say that your problem is most probably on the other and of the tunnel - on the ASA. IPsec SA are up, which means the VPN settings are correct, BUT: Can you confirm that the traffic from the tunnel is allowed on the ASA? Can you confirm the rest of the path has a correct route back to the ASA? Is there any NAT applied on the tunnel traffic on the ASA?

Having the fact that you have some proxy ids up and running eliminates any issues with phase1 setting and peer reachability
Having the fact that the problematic proxy ids are also up, but you see only uni-directional traffic eliminates any issues with phase2 encryption domains/selectors.

[Venkatesan_radhakrishnan]

HI Alex,

Thanks for your reply, I will look on the ASA side. 

I can understand this point Can you confirm the rest of the path has a correct route back to the ASA

I will check the remaning asap.