Proxy-ID Error message for GlobalProtect Client

[Don_Russell]

We have configured a GlobalProtect Gateway to service clients using both the GP Agent and X-Auth parameters with 3rd Party Clients.

We have been receiving the following error messages:

'IKE phase-2 negotiation failed when processing proxy ID. cannot find matching phase-2 tunnel for received proxy ID. received local id: 10.0.0.0/8 type IPv4_subnet protocol 0 port 0, received remote id: 10.10.2.5/32 type IPv4_address protocol 0 port 0.'

The Object shown in the error messages identifies the name of our GlobalProtect Gateway. 

I am surprised to find Phase-2 Proxy-ID error messsages associated with a GP Gateway. Any thoughts on what might be the cause of this?

[Remo · Accepted solution]

Hi @Don_Russell

Behind the scenes global protect is nothing else than a standard IKE/IPSec tunnel (with additional features).

What routes did you configure in your global protect gateway settings? Is 10.0.0.0/8 configured? And also does the client IP match the IP pool you have configured? If not, then it looks like a third party client has changed the settings manually on the local client and so does not accept the settings from your gateway.

[Don_Russell]

Thank you, @Remo! That was what I needed to know. I greatly appreciate the help!