VPN between Palo Alto and Check Point firewall

Showing results for 
Search instead for 
Did you mean: 

VPN between Palo Alto and Check Point firewall

L1 Bithead


I am trying to establish a successful VPN connection between my Palo Alto firewall and a Check Point firewall. The VPN tunnel on the Palo Alto side shows all green for phase 1 and 2, however on the Check Point side I keep getting a failure per the log "IKE failure no response from peer".

In the "Monitor" > "System" log of the Palo Alto the message I am seeing is "ike-nego-p2-proxy-id-bad" "IKE phase-2 negotiation failed when processing proxy ID. cannot find matching phase-2 tunnel for received proxy ID. received local ID type IPv_4_subnet protocol 0 port 0, received remote id: type IPv4_subnet protocol 0 port 0.

On the Check Point side the local network is the I am using a "encryption domain" on the Check Point.

I do not have any Proxy ID's configured on the Palo Alto side. I am under the impression that routing the traffic for destination to the tunnel interface as a static route is all that is needed to identify the remote private network.

On the Palo Alto for the IKE crypto profile I am using Suite-B-GCM-128, and IPSec Crypto Profile Suite-B-GCM-128.


I have tried a proxy ID on the palo alto side with local being (the local Palo Alto private network) and remote (the Check Point side private network) and that brought the tunnel on the Palo Alto side down.  After this I only have a green light for IKE Info under status of the IPsec Tunnels area.


L1 Bithead

After removing the proxy ID on the Palo Alto side I now receive:




Any help on this will be greatly appreciated!

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!