About Arnesh

Hi @ISG-JHAH    Are you checking the status of the IPSec from GUI? The status of the Phase-2 will stay UP (Green on GUI) as long as even 1 proxy ID is UP among all in Phase-2 tunnels. Please check if the status of the proxy-ID is indeed UP? To check the status, run the below command from the CLI.   show vpn tunnel name <name-of-proxy-id> You will get information like LOCAL PROXY ID, REMOTE PROXY ID, ports etc in output.   The VPN logs generated as responder gives more information as suggested by You can review the system logs and ikemgr logs, during the issue time frame.   You can also refer to the below KBs: How to Troubleshoot IPSec VPN connectivity issues  IKEv1 VPN error logs - Troubleshooting  IPSec and Tunneling Resource list on Configuring and Troubleshooting    Regards, ... View more

Hi @suba_muthuram  Yes, the certificate should be installed. However, it depends on how to want to deploy the certificates. Below is the snippet from the GlobalProtect Admin-Guide: For an agent configuration profile that specifies client certificates, each user receives a client certificate. The mechanism for providing the certificates determines whether a certificate is unique to each user or the same for all users under that agent configuration: • To deploy client certificates that are unique to each user and endpoint, use SCEP. When a user first logs in, the portal requests a certificate from the enterprise’s PKI. The portal obtains a unique certificate and deploys it to the endpoint. • To deploy the same client certificate to all users that receive an agent configuration, deploy a certificate that is Local to the firewall.   ... View more