IPSec VPN with Cisco ASA behind NAT

[arnljot]

I'm trying to establish a ipsec VPN tunnel with a Cisco ASA with a peer address behind a NAT fw.  We have checked all ike and ipsec crypto parameters, and successfully established vpn with Cisco ASA before.

Phase 1 is failing due to time out, and we get a log entry that indicate that the private peer address (which is behind NAT) is "visiblie" to the PAN local peer.

Black strike out is the local gw ip public address, and red is the public peer (NAT) ip

The address in the top event is the private GW address that is behind NAT.  I did not expect the PAN box on our side to see this address.

NAT Traversal is on, on both sides.

This is how Phase-1 times out with the following log entries (never mind the time stamp, I did not clip the corresponding log entries)

I have monitored the mp-log/ikemgr.log with debug on, but get no hints as to why this is failing.

Appreciate any help resolving this issue

[UhMayYeah]

Can you try to set

Local ID  on ASA =Public IP of the NAT device &&

Peer Identification on PA firewall = Public IP of the NAT device under ike-gateway on PA.

[arnljot · Accepted solution]

This was a bug in PANOS.  Probably some memory leak.  A reboot solved the issue, and I believe this problem has been solved in a later release.