Palo Alto VM300 is not responding to the incoming IKE_SA_INIT request

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Palo Alto VM300 is not responding to the incoming IKE_SA_INIT request

L0 Member

Hi there,

   I am experiencing a weird behavior of my VM-Series PA running PanOS 10.0.4

   I am trying to construct 2 VPN tunnels. First tunnel is IKEv1 toward CiscoASA. This tunnel is up and running like a charm.

   However, my second tunnel toward a Google Cloud VPN, using IKEv2, my PA is ignoring the IKE_SA_INIT from the Google.

   I have check all configuration are good and matched on both end. The following is puzzling me.

   1) I used Packet Capture (GUI) to capture the raw packets and examine the traffic using Wireshark. I am able to see the incoming IKE_SA_INIT request from Google addressing to my PA IP at UDP port 500. But, there is no single reply from PA. It is like unidirectional traffic, I have ensured my filter is monitoring both way because I can see traffic toward Cisco ASA in the capture.

    2) I then turned on the ike debug by running "debug ike global on debug" and "tail follow yes mp-log ikemgr.log". To my surprise, I did not see any IKE_SA_INIT from Google in the log. Note : I can see the detail transaction from Cisco ASA.

    3) I then turned on the pcap debug by using "debug ike pcap on" and use "view-pcap no-dns-lookup yes no-port-lookup yes follow yes debug-pcap ikemgr.pcap" . Again, I can't see any traffic from Google. The Google is sending the IKE_SA_INIT repeatedly. But I can't see even a single one.

   I am wondering if anyone have any clue about this weird behavior?


p/s : I noticed in the wire-shark that the same INIT was also forwarded to an IP in my INT zone where is my EXT IP and is my app server (proxy id) sitting in INT zone which can't be reach from internet. Why am I see that packet?







L0 Member

Hi, I am facing the absolute same issue on a PA440. I have a 1st Tunnel to a ASA (IKEV2) and a second tunnel to some sort of legacy device with dynamic ip. The SA INIT is received, but the PA does not respond. Was your Problem solved?


Regards, Yanneck

Hi Yanneck,

    Yes, I have solved the issue. It was due to the staled seesion.

    You can issue the following command to check if there is any stale session.


# show session all filter source <source IP> destination <your PA IP>

ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port])
Vsys Dst[Dport]/Zone (translated IP[Port])
87 ike ACTIVE FLOW ND < source IP>[500]/INM-PA-ZN-WAN/17 (< source IP>[500])
vsys1 <your PA>[500]/INM-PA-ZN-WAN (<your PA IP>[500])


Identify the session ID and issue the command "clear session id <id>". For my case, it was 87 (as shown above). So, substituted <id> with 87.


Hope that helps!




  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!