TMG 2010 ipsec vpn

[cskodras]

Hello,

I'm trying to set up a site to site vpn with TMG 2010 (SP2) on the other point and is failing at phase 2.

The systems logs in PA-500 shows 'Invalid ID information (18)'. This is subnet mismatch between the two end points but I am sure that it's correct as i have doublechecked everything.

In remote networks of TMG I enter 192.168.1.0 - 192.168.1.255 (as you define it only by ip range) and in proxy id of PA i type 192.168.1.0/24.

Has anyone succesfully setup an IPSec VPN with PA and TMG?

Any help would be greatly appreciated.

Thank you

[sspringer]

Hello,

Can you try to set the proxy ID as a single host?

Do you get the same error on the TMG side when the PA-500 initiates the tunnel?

It may be worthwhile to gather packet captures and compare the proxy-ID that is being sent/received to see if there is difference.

- Stefan

[Thiago · Accepted solution]

Hello CSKodras ,

I hade the same problem last week.

PAN Firewall allow proxy id`s just with IP/SUBNET

SO you need to change in your TMG to IP/SUBNET and you phase 2 will function,

CHANGE TMG to IP/SUBNET 192.168.0.1/24 in your TMG ,  site-to-site VPN will function.

On Phase 2 IPSEC VPN , PAN and TMG switch yours networks and needs to be the same or Phase 2 will mismatch

[cskodras]

Hello gruposeguranca,

Thank you for the info. It worked to me as well.