Query on DH group for IPSEC VPN

[FarzanaMustafa]

We are having issue in building an IPSEC tunnel on a Palo firewall. Using ver 9.1.2.

Getting below error

'IKE phase-1 negotiation is failed. Couldn't find configuration for IKE phase-1 request for peer IP...

The peer IP type is Dynamic with no proxy ID in use. We are using IKEv1, DPD is disabled, NAT-t is enabled, Phase1 & 2 are matching at both ends, Exchange modes are also matching. PA is enabled in passive mode.

We had to set DH Group to no-pfs under IPsec crypto profile.

When setting no-pfs value is there any other setting we need to set on palo side for the tunnel to work?

[OtakarKlier]

Hello,

The phase 1 properties are not correct for both sides of the tunnel. The 'receiving' side of the VPN should provide more information as to why. However start with the basics and make sure your ike settings are identical on both devices.

Also check your logs to make sure you are not dropping any of the traffic (doesnt sound like it however).

Regards,