VPN PA-400 to PFSense

[admin]

Hi all!

I've created an IPsec VPN site-to-site between Palo Alto and PFSense.

We are facing problems because the tunnel doesn't connect. We see the errors below on Monitor Logs:

Error1 = IKEv2 IKE SA negotiation is started as responder, non-rekey. Initiated SA: IP_PALO_ALTO[500]-IP_PFSENSE[33848] SPI:1719700341f53997:4c83ee594abb7b38.

Error2 = ignoring unauthenticated notify payload (NAT_DETECTION_SOURCE_IP

Do you know what could be the problem?

The VPN worked with another firewall.

We already tried:

• Change psk
• Change the internet line
• Change encryption options
• Check date/time
• Check policies
• Check ports 500 and 4500

Help!

[kiwi]

Hi @admin ,

Further debugging is required. 

I'd start by confirming both VPN peers can actually reach each other.

Start off by these troubleshooting tips:
How to Troubleshoot IPSec VPN connectivity issues

Here are some more debugging tips and usecases:
https://live.paloaltonetworks.com/t5/support-faq/support-faq-how-to-troubleshoot-ipsec-vpn-connectiv...

Kind regards,

-Kim.