Site to Site VPN with error Failed SA

[MohamedSharief]

Hi,

We have configured a site to site vpn between palo alto and cisco ASA. However, both sites are static and PA is the intiator, ACL is configured properly on Cisco side but I got the error:

"IKE Phase-2 negotiation is failed as initiator, quick mode, Failed SA: 213.42.x.x [4500] - 185.141.x.x [4500] message id:xxxxx. Due to negotiation timeout".

Proxy IDs on PA is:- Local: 10.12.20.11 Remote: 192.168.248.215

ACL on Cisco: access-list TEST extended permit ip object NETWORK_OBJ_192.168.248.215 object TEST_OBJECT

Where TEST_OBJECT is 10.12.20.11

I tried a different transform-set on both sides but still the same.

Currently on PA: 3des-SHA1-DH5 life time 1 day

Currently on Cisco:

crypto map FEWA_IPSEC_MAP 4 match address TEST

crypto map FEWA_IPSEC_MAP 4 set pfs group5
crypto map FEWA_IPSEC_MAP 4 set peer 213.42.x.x
crypto map FEWA_IPSEC_MAP 4 set ikev1 transform-set ESP-3DES-SHA-TRANS
crypto map FEWA_IPSEC_MAP 4 set security-association lifetime seconds 86400 

crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac

Usually when I troubleshoot cisco side I don't have the transform-set ending with TRANS but as the client said its just a "name" for the transform-set. Can anyone with Cisco experience confirm this?

Regards,

Sharief

[MohamedSharief · Accepted solution]

Hi,

Just a quick update. The client sent the "complete" configurations on ASA and we found the following:

crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport

PAN doesn't support transport mode and its only works with tunnel mode.

After removing this command the tunnel came up.

Thanks for your help.

Regards,

Sharief