IPSec VPN issue

[Javith]

Hi All,

We have configured IPSec VPN between PAN and AWS. 

When i iniate the tunnel, IPSec and IKE SA installed successfully as a initiator.

then, IKE protocol IPSec SA delete message sent to peer. SPI:0x...

After a second, IPSec key deleted. Deleted SA..... please suggest 

[santonic]

Soundslike some reachibility test fails. Check if you are dropping something towards AWS peers.

[pankaku]

Does the phase one is comming up? If yes then the issue with proxy ID.

Have you opened the udp port 500 and udp 4500 on the AWS?

Are you able to ping the public IP address?

[Raido_Rattameister]

Can you set vpn on Palo into passive mode and initiate vpn from other side?

System log on Palo shows pretty exactly at what state vpn fails.

[OtakarKlier]

The only options are Main, Auto, and Agressive. You can play with those. But like pakumar pointed out. If its phase 2, it could be proxy id's.

Its under Ike Gateway -> Advanced Phase 1 options.

[OtakarKlier]

Of course i didnt look very hard, Yes there is a Passive option in the IKE gateway.

[santonic]

According to original post (Quote:"When i iniate the tunnel, IPSec and IKE SA installed successfully as a initiator.") I'd say all parameters are ok and IPSEC is esatblished sucesfully but DPD mechanism kicks in and takes it down.