Site-to-Site VPN - Palo alto to Cisco Router issue

[netsupport1]

Hi guys,

I'm doing a POC for S2S VPN but i cannot get it to work, I'm sure this is a simple thing i have overlooked, a ping from PC2 to PC1, the ping is encapsulated and encrypted ESP on the way over to PC1, but the return traffic is not..... i have the following topology;

Now i have set up a site to site VPN from the PA to R2 with the following attributes;

And with a ping from PC2 to PC1, IKE phase 1 and 2 come up.....but the ping fails

And the capture of the ping....outbound ESP, return traffic ICMP...

Confi on the Cisco router;

!

crypto isakmp policy 1

encr aes

authentication pre-share

group 2

lifetime 3600

crypto isakmp key cisco address 192.168.3.2

!

!

crypto ipsec transform-set Myset esp-aes esp-sha-hmac

!

crypto map Mymap 1 ipsec-isakmp

set peer 192.168.3.2

set transform-set Myset

match address 100

!

!

!

interface FastEthernet0/0

ip address 192.168.3.100 255.255.255.0

duplex auto

speed auto

crypto map Mymap

!

!

access-list 100 permit ip 172.16.2.0 0.0.0.255 172.16.1.0 0.0.0.255

access-list 100 permit ip 172.16.1.0 0.0.0.255 172.16.1.0 0.0.0.255

!

Any ideas guys?

[sbabu]

Hi,

This looks like configuration issue. You created static route for "172.16.2.0/24" pointing towards tunnel.1. However, you created tunnel between PA and R2 router. So you need to create static route for 172.16.1.0/24 and next hop as tunnel interface and redistribute this static route into OSPF. Also you need to remove the static route which configured for "172.16.2.0/24".

Regards,

P.Sarath

[Dz3015]

Agreed, according to the drawing the wrong subnet is pointed at the tunnel.

[sbabu · Accepted solution]

Also I believe ACL configuration on the Cisco device is not correct. You mentioned same subnet in ACL source and destination.

"access-list 100 permit ip 172.16.1.0 0.0.0.255 172.16.1.0 0.0.0.255"

Regards,

P.Sarath

[netsupport1]

So sorry guys, i documented the topo wrong, the two LAN subnets are swapped;

So the static is correct i believe, 172.16.1.0/24 to tunnel .1

Thank you all so so much for your help thus far, sorry about the bum steer!

regards

[parmas]

So I think your problem is a typo in the ACL configured on the router. Make sure you have it like this:

access-list 100 permit ip 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255

access-list 100 permit ip 172.16.2.0 0.0.0.255 172.16.1.0 0.0.0.255

Thanks,