Site-2-Site IPSEC Tunnel won't come online

[EDSAadmin]

i have three offices:

office 1: US - northeast    1.1.1.1  PAN-500HA

Office 2: US - southeast   2.2.2.2 PAN-3020HA  HQ site

Office 3: Shanghai China  3.3.3.3 PAN-200

all three IPSEC tunnels were up and running.  My Office 3 moved locations and when they did that we obtained a new static IP from the executive office we moved into. We updated the firewalls with the new external interface IP, IPSEC tunnel info on the local and updated all peer sites. committed the changes. after the commit office 1 and office 3 tunnel came up no problem. but office 2 and office 3 will not come up. We have deleted the config on both office 2 and office 3  and reconfigured. we have reboot both firewalls, reboot the router in office 2, we have changed the preshared key on both sites. triple checked our routes are correct in each virtual router. Contacted both ISP to make sure they are not blocking any UDP 500, 4500 or ESP traffic. they both say all IP's ports and protocols are open.

What we are seeing in the logs is office 3 is initiating ike phase 1 traffic out, but the peer box is not seeing any traffic coming in from office 3 nor is it initiating anything out to it either.  In the ike gateway for each we have it currently set to:

Exchange mode: main

IKE Crypto Profile: set at default for troubleshooting purposes

Unchecked "Enable passive mode"

Checked "Enable NAT traversal"

I have an open ticket with support but they have been unable to figure  out the problem yet. It has been escalated but i am still waiting for a callback today to continue working on it.

Has anyone run into this and if so how did you get it working again?

Any help would be greatly appreciated.

HQ Site

Shanghai Site

[HULK]

Good to see, the case has been closed today.

Thanks

[EDSAadmin]

We found the problem. On our HQ firewall we have a clean up rule set.  When we put that in initially it caused all of our tunnels to go down since it was dropping the ike phase 1 traffic. We put a VPN tunnel policy in place, with source zone external  and all four site external IP's and destination zone with all four external IP's one for each site allowing any app, and any service. Stupid me i forgot we had to set that up and that policy had the old IP address in it. once we updated the policy with the new IP and commited the tunnel came up no problem.

Thanks for all your help. 

[panos]

good to hear that is solved.implicity deny should be written always carefully.