IPSec VPN issue between Palo and MS Azure

[TranceforLife]

Hi Guys,

Having problems with a site2site VPN connection on a palo alto firewall. It seems to randomly drop and stop working. Sometimes it will stay up for days then drop and other times it stays up for about an hour and then drop. I have followed various guides from palo and Microsoft (this is a VPN to MS Azure) on how to configure it and as I say it works but seemingly decides to drop for reasons unknown.

Any ideas?

Thank you,

[jdelio]

So, we know the IPSEC tunnell is using IKEv2, as is stated here.

We also know that the error states "lacks KE Payload", So I looked for that.. and found this from:

https://tools.ietf.org/html/rfc4306

RFC 4306                         IKEv2                     December 2005


   A CHILD_SA is created by sending a CREATE_CHILD_SA request.  The
   CREATE_CHILD_SA request MAY optionally contain a KE payload for an
   additional Diffie-Hellman exchange to enable stronger guarantees of
   forward secrecy for the CHILD_SA.  The keying material for the
   CHILD_SA is a function of SK_d established during the establishment
   of the IKE_SA, the nonces exchanged during the CREATE_CHILD_SA
   exchange, and the Diffie-Hellman value (if KE payloads are included
   in the CREATE_CHILD_SA exchange).

   In the CHILD_SA created as part of the initial exchange, a second KE
   payload and nonce MUST NOT be sent.  The nonces from the initial
   exchange are used in computing the keys for the CHILD_SA.

It talks about there being an Optional KE Payload.  .. but the KE is the Key Exchange info..

And because the PAN is a "responder" in this IPSEC setup, it sounds like the PAN side is looking for the KE packet, but is not seeing it, thus not bringing the tunnel up.

I would recommend talking with the Azure end, and seeing if they have this configured or not.

At the same time, I would recommend you checking the Crypto settings and ensure that all values match for Phase 1 - IKE and Phse 2 - IPSEC.

It sounds like after you confirm this info, that giving support here a call and they can continue working with you if you cannot get the tunnel working.