03-31-2015 06:08 PM
Hello support community,
I'm using a PAN 3020 A/P cluster on the perimeter running 6.0.9. At all of my remote sites I have a cisco ASA that uses IPSEC tunnels to connect back to the main network. The IPSEC tunnel configuration (IKE phase 1, IKE phase 2, and peer IDs) are consistent across my remote sites (best to my knowledge). Out of my 8 IPSEC tunnels, when I try to initiate the tunnel to one site I receive the following in the system logs where X is the remote peer and Y is the local peer: "received unencrypted Notify payload (NO-PROPOSAL-CHOSEN) from IP X.X.X.X[500] to Y.Y.Y.Y[500], ignored." I then get: "IKE phase-1 negotiation is failed as initiator, main mode. Failed SA: Y.Y.Y.Y[500]-72.28.162.32[500] cookie:cbf02ee495115ae1:0000000000000000. Due to timeout.'
If the PAN is the responder, the tunnel comes up: "IKE phase-1 negotiation is succeeded as responder, main mode. Established SA: Y.Y.Y.Y[500]-X.X.X.X[20796] cookie:2790c31cdce7deae:05a5f962eee2989b lifetime 86400 Sec."
Looking at the interpret-vpn-error-messages.html page, I would think if there was a proposal mismatch in the IKE Crypto profile, it would fail as both initiator and responder. I've verified the isakmp policy on the cisco side matches what's configured in the IKE Crypto policy, and I've verified the firewall is allowing the traffic via security policy.
Any ideas why I'm failing as an initiator?
