About Amnuay

Hi HULK, ^^ here what I've seen. It is not possible to ping from the VPN gateway IP of the PAN to the VPN gateway IP of the firewall at the other end of the tunnel. [AM] Yes this from PAN cannot ping to another VPN gateway because it was not allow on PAN. But after allow it still have same problem. It is possible to ping from the PAN to the VPN gateway IP of the other firewall if a source IP (PAN VPN gateway IP) is not specified. [AM] Nah, After policy to allow traffic was added. either specify or not specify source IP ping is success. The IPSec VPN is working correctly. [AM] the VPN never came up since it "likly" mismatch -_-" VPN configuration is correct on both firewalls. [AM] Yes I think so. Just PAN that newly established but the same configuration as others. Security policy configuration is correct on both firewalls. [AM] Yes all required IPSec traffic has been allow. I am really doubt in pre-shared key likly not match how come this happen and anyway to do deep diagnostic? Again I type and retype start from general complexity 20 char with symbol and number like other firewall brands but not success and I move down a little but now its very simple 15 char only still "likely" not match T^T ... View more

Hi HULK, Thanks for your reply ^^ I've tried your suggestion but still no luck. I try to examine the hash of pre-shared key no both side but I think it will not help (Just in case it stored with the same hash but it turn out different but I don't doubt that) Here's what I got on ScreenOS. 2014-01-13 17:36:27    info    IKE "PAN-IP" phase 1:The symmetric crypto key has been generated successfully. 2014-01-13 17:36:27    info    IKE"ScreenOS-IP" "PAN-IP" Phase 1: Initiated negotiations in main mode. 2014-01-13 17:36:15    info    IKE "PAN-IP" Phase 1: Retransmission limit has been reached. 2014-01-13 17:35:27    info    IKE "PAN-IP" phase 1:The symmetric crypto key has been generated successfully. 2014-01-13 17:35:27    info    IKE"ScreenOS-IP" "PAN-IP" Phase 1: Initiated negotiations in main mode. 2014-01-13 17:35:15    info    IKE "PAN-IP" Phase 1: Retransmission limit has been reached. 2014-01-13 17:34:27    info    IKE "PAN-IP" phase 1:The symmetric crypto key has been generated successfully. 2014-01-13 17:34:27    info    IKE"ScreenOS-IP" "PAN-IP" Phase 1: Initiated negotiations in main mode. and here from PAN-OS 5.0.5 1    13-01-14 17:46    9401000816    SYSTEM    vpn    0    13-01-14 17:46        ike-nego-p1-delete    Office_VPNGW    0    0    general    informational    IKE phase-1 SA is deleted SA: "PAN-IP"[500]-"ScreenOS-IP"[500] cookie:55d138c5d3a1bffd:4b28a9d9c57d8fbd.    64352    0x0 1    13-01-14 17:46    9401000816    SYSTEM    vpn    0    13-01-14 17:46        ike-nego-p1-fail    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed as responder, main mode. Failed SA: "PAN-IP"[500]-"ScreenOS-IP"[500] cookie:55d138c5d3a1bffd:4b28a9d9c57d8fbd. Due to timeout.    64351    0x0 1    13-01-14 17:45    9401000816    SYSTEM    vpn    0    13-01-14 17:45        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64350    0x0 1    13-01-14 17:45    9401000816    SYSTEM    vpn    0    13-01-14 17:45        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64349    0x0 1    13-01-14 17:45    9401000816    SYSTEM    vpn    0    13-01-14 17:45        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64348    0x0 1    13-01-14 17:45    9401000816    SYSTEM    vpn    0    13-01-14 17:45        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64347    0x0 1    13-01-14 17:45    9401000816    SYSTEM    vpn    0    13-01-14 17:45        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64346    0x0 1    13-01-14 17:45    9401000816    SYSTEM    vpn    0    13-01-14 17:45        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64345    0x0 1    13-01-14 17:45    9401000816    SYSTEM    vpn    0    13-01-14 17:45        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64344    0x0 1    13-01-14 17:45    9401000816    SYSTEM    vpn    0    13-01-14 17:45        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64343    0x0 1    13-01-14 17:45    9401000816    SYSTEM    vpn    0    13-01-14 17:45        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64342    0x0 1    13-01-14 17:45    9401000816    SYSTEM    vpn    0    13-01-14 17:45        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64341    0x0 1    13-01-14 17:45    9401000816    SYSTEM    vpn    0    13-01-14 17:45        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64340    0x0 1    13-01-14 17:45    9401000816    SYSTEM    vpn    0    13-01-14 17:45        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64339    0x0 1    13-01-14 17:45    9401000816    SYSTEM    vpn    0    13-01-14 17:45        ike-nego-p1-start    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is started as responder, main mode. Initiated SA: "PAN-IP"[500]-"ScreenOS-IP"[500] cookie:55d138c5d3a1bffd:4b28a9d9c57d8fbd.    64338    0x0 1    13-01-14 17:45    9401000816    SYSTEM    vpn    0    13-01-14 17:45        ike-nego-p1-delete    Office_VPNGW    0    0    general    informational    IKE phase-1 SA is deleted SA: "PAN-IP"[500]-"ScreenOS-IP"[500] cookie:b8cfe8c9f96e4225:b688c89484088d3c.    64337    0x0 1    13-01-14 17:45    9401000816    SYSTEM    vpn    0    13-01-14 17:45        ike-nego-p1-fail    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed as responder, main mode. Failed SA: "PAN-IP"[500]-"ScreenOS-IP"[500] cookie:b8cfe8c9f96e4225:b688c89484088d3c. Due to timeout.    64336    0x0 1    13-01-14 17:44    9401000816    SYSTEM    vpn    0    13-01-14 17:44        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64335    0x0 1    13-01-14 17:44    9401000816    SYSTEM    vpn    0    13-01-14 17:44        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64334    0x0 1    13-01-14 17:44    9401000816    SYSTEM    vpn    0    13-01-14 17:44        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64333    0x0 1    13-01-14 17:44    9401000816    SYSTEM    vpn    0    13-01-14 17:44        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64332    0x0 1    13-01-14 17:44    9401000816    SYSTEM    vpn    0    13-01-14 17:44        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64331    0x0 1    13-01-14 17:44    9401000816    SYSTEM    vpn    0    13-01-14 17:44        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64330    0x0 1    13-01-14 17:44    9401000816    SYSTEM    vpn    0    13-01-14 17:44        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64329    0x0 1    13-01-14 17:44    9401000816    SYSTEM    vpn    0    13-01-14 17:44        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64328    0x0 1    13-01-14 17:44    9401000816    SYSTEM    vpn    0    13-01-14 17:44        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64327    0x0 1    13-01-14 17:44    9401000816    SYSTEM    vpn    0    13-01-14 17:44        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64326    0x0 1    13-01-14 17:44    9401000816    SYSTEM    vpn    0    13-01-14 17:44        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64325    0x0 1    13-01-14 17:44    9401000816    SYSTEM    vpn    0    13-01-14 17:44        ike-nego-p1-fail-psk    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is failed likely due to pre-shared key mismatch.    64324    0x0 1    13-01-14 17:44    9401000816    SYSTEM    vpn    0    13-01-14 17:44        ike-nego-p1-start    Office_VPNGW    0    0    general    informational    IKE phase-1 negotiation is started as responder, main mode. Initiated SA: "PAN-IP"[500]-"ScreenOS-IP"[500] cookie:b8cfe8c9f96e4225:b688c89484088d3c.    64323    0x0 T^T ... View more

Hi nbilly, Any possibility on services object to be configured? Because on NAT Policy I can't configure application. Just want to NAT for Client VPN only. Thanks ^^ AM.     ... View more

I will change it back to Physical Interface then ^^ ... View more

Hello Karthik, Thank you for your reply. I have applied it under clear Text but seems that on "QoS Interface" Level it allow only physical interface. In this section is specified as source interface so no problem for incoming but outgoing wise. ^^ Any other suggestion you may have? Cheers, AM ... View more