Palo Alto VM300 is not responding to the incoming IKE_SA_INIT request

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Palo Alto VM300 is not responding to the incoming IKE_SA_INIT request

L0 Member

Hi there,

   I am experiencing a weird behavior of my VM-Series PA running PanOS 10.0.4

   I am trying to construct 2 VPN tunnels. First tunnel is IKEv1 toward CiscoASA. This tunnel is up and running like a charm.

   However, my second tunnel toward a Google Cloud VPN, using IKEv2, my PA is ignoring the IKE_SA_INIT from the Google.

   I have check all configuration are good and matched on both end. The following is puzzling me.

   1) I used Packet Capture (GUI) to capture the raw packets and examine the traffic using Wireshark. I am able to see the incoming IKE_SA_INIT request from Google addressing to my PA IP at UDP port 500. But, there is no single reply from PA. It is like unidirectional traffic, I have ensured my filter is monitoring both way because I can see traffic toward Cisco ASA in the capture.

    2) I then turned on the ike debug by running "debug ike global on debug" and "tail follow yes mp-log ikemgr.log". To my surprise, I did not see any IKE_SA_INIT from Google in the log. Note : I can see the detail transaction from Cisco ASA.

    3) I then turned on the pcap debug by using "debug ike pcap on" and use "view-pcap no-dns-lookup yes no-port-lookup yes follow yes debug-pcap ikemgr.pcap" . Again, I can't see any traffic from Google. The Google is sending the IKE_SA_INIT repeatedly. But I can't see even a single one.

   I am wondering if anyone have any clue about this weird behavior?

 

p/s : I noticed in the wire-shark that the same INIT was also forwarded to an IP in my INT zone where 10.128.140.69 is my EXT IP and 10.128.140.160 is my app server (proxy id) sitting in INT zone which can't be reach from internet. Why am I see that packet?

 

BernardGoh_3-1647463215990.png

 

Regards

Bernard

0 REPLIES 0
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!