1

I have PaloAlto (PA) and Cisco ASA 5585-X located on two different sites, trying to configure IPsec VPN tunnel.

[PA]-----------(internet)-----------[Cisco ASA]

If i ping from Cisco ASA side lan to PA then my tunnel coming up and everything works both side of PC can communicate. But when tunnel is down and if PA side of LAN trying to send traffic to Cisco ASA it failed to bring up tunnel.

When i run debug on Cisco ASA i found following, also when tunnel is up i am seeing following messaged in debugging, not sure what is going on. if my config was wrong then tunnel shouldn't come up when Cisco ASA sending traffic. what i am missing here

Palo Alto IP: 1.1.1.1
Cisco ASA IP: 2.2.2.2

Cisco ASA iKev2 and IPsec parameters:

crypto ikev2 policy 30
 encryption aes
 integrity sha256
 group 2
 prf sha256
 lifetime seconds 28800

crypto ipsec ikev2 ipsec-proposal TRANSFORM-ESP-AES-SHA
 protocol esp encryption aes
 protocol esp integrity sha-256

debug:

IKEv2-PROTO-2: (282): Received Packet [From 1.1.1.1:500/To 2.2.2.2:500/VRF i0:f0]
(282): Initiator SPI : D34E003E0752B818 - Responder SPI : 00AA509B0EC33790 Message id: 379
(282): IKEv2 CREATE_CHILD_SA Exchange REQUESTIKEv2-PROTO-3: (282): Next payload: ENCR, version: 2.0 (282): Exchange type: CREATE_CHILD_SA, flags: INITIATOR (282): Message id: 379, length: 444(282):
Payload contents:
(282):
(282): Decrypted packet:(282): Data: 444 bytes
(282): REAL Decrypted packet:(282): Data: 368 bytes
IKEv2-PROTO-5: (282): SM Trace-> SA: I_SPI=D34E003E0752B818 R_SPI=00AA509B0EC33790 (R) MsgID = 0000017B CurState: READY Event: EV_RECV_CREATE_CHILD
IKEv2-PROTO-5: (282): Action: Action_Null
IKEv2-PROTO-5: (282): SM Trace-> SA: I_SPI=D34E003E0752B818 R_SPI=00AA509B0EC33790 (R) MsgID = 0000017B CurState: CHILD_R_INIT Event: EV_RECV_CREATE_CHILD
IKEv2-PROTO-5: (282): Action: Action_Null
IKEv2-PROTO-5: (282): SM Trace-> SA: I_SPI=D34E003E0752B818 R_SPI=00AA509B0EC33790 (R) MsgID = 0000017B CurState: CHILD_R_INIT Event: EV_VERIFY_MSG
IKEv2-PROTO-2: (282): Validating create child message
IKEv2-PROTO-5: (282): SM Trace-> SA: I_SPI=D34E003E0752B818 R_SPI=00AA509B0EC33790 (R) MsgID = 0000017B CurState: CHILD_R_INIT Event: EV_CHK_CC_TYPE
IKEv2-PROTO-2: (282): Check for create child response message type
IKEv2-PROTO-5: (282): SM Trace-> SA: I_SPI=D34E003E0752B818 R_SPI=00AA509B0EC33790 (R) MsgID = 0000017B CurState: CHILD_R_IPSEC Event: EV_PROC_MSG
IKEv2-PROTO-2: (282): Processing CREATE_CHILD_SA exchange
IKEv2-PROTO-1: (282): Failed to find a matching policy
IKEv2-PROTO-1: (282): Received Policies:
IKEv2-PROTO-1: (282): Failed to find a matching policy
IKEv2-PROTO-1: (282): Expected Policies:
IKEv2-PROTO-5: (282): Failed to verify the proposed policies
IKEv2-PROTO-1: (282): Failed to find a matching policy
IKEv2-PROTO-1: (282):
IKEv2-PROTO-5: (282): SM Trace-> SA: I_SPI=D34E003E0752B818 R_SPI=00AA509B0EC33790 (R) MsgID = 0000017B CurState: CHILD_R_IPSEC Event: EV_NO_PROP_CHOSEN
IKEv2-PROTO-2: (282): Sending no proposal chosen notify
IKEv2-PROTO-2: (282): Building packet for encryption.
(282):
Payload contents:
(282):  NOTIFY(NO_PROPOSAL_CHOSEN)(282):   Next payload: NONE, reserved: 0x0, length: 8
(282):     Security protocol id: ESP, spi size: 0, type: NO_PROPOSAL_CHOSEN
IKEv2-PROTO-5: (282): SM Trace-> SA: I_SPI=D34E003E0752B818 R_SPI=00AA509B0EC33790 (R) MsgID = 0000017B CurState: CHILD_R_IPSEC Event: EV_ENCRYPT_MSG
IKEv2-PROTO-2: (282):
IKEv2-PROTO-5: (282): SM Trace-> SA: I_SPI=D34E003E0752B818 R_SPI=00AA509B0EC33790 (R) MsgID = 0000017B CurState: CHILD_R_IPSEC Event: EV_NO_EVENT
IKEv2-PROTO-5: (282): Locked SA.Event EV_FREE_NEG queued in the state EXIT
IKEv2-PROTO-5: (282): SM Trace-> SA: I_SPI=D34E003E0752B818 R_SPI=00AA509B0EC33790 (R) MsgID = 0000017B CurState: CHILD_R_IPSEC Event: EV_OK_ENCRYPT_RESP
IKEv2-PROTO-5: (282): Action: Action_Null
IKEv2-PROTO-5: (282): SM Trace-> SA: I_SPI=D34E003E0752B818 R_SPI=00AA509B0EC33790 (R) MsgID = 0000017B CurState: CHILD_R_IPSEC Event: EV_TRYSEND
(282):
IKEv2-PROTO-2: (282): Sending Packet [To 1.1.1.1:500/From 2.2.2.2:500/VRF i0:f0]
(282): Initiator SPI : D34E003E0752B818 - Responder SPI : 00AA509B0EC33790 Message id: 379
(282): IKEv2 CREATE_CHILD_SA Exchange RESPONSEIKEv2-PROTO-3: (282): Next payload: ENCR, version: 2.0 (282): Exchange type: CREATE_CHILD_SA, flags: RESPONDER MSG-RESPONSE (282): Message id: 379, length: 76(282):
Payload contents:
(282):  ENCR(282):   Next payload: NOTIFY, reserved: 0x0, length: 48
(282): Encrypted data: 44 bytes
(282):
IKEv2-PROTO-5: (282): SM Trace-> SA: I_SPI=D34E003E0752B818 R_SPI=00AA509B0EC33790 (R) MsgID = 0000017B CurState: CHILD_R_DONE Event: EV_FAIL
IKEv2-PROTO-1: (282): Create child exchange failed
IKEv2-PROTO-1: (282):
IKEv2-PROTO-2: (282): IPSec SA create failed
IKEv2-PROTO-5: (282): SM Trace-> SA: I_SPI=D34E003E0752B818 R_SPI=00AA509B0EC33790 (R) MsgID = 0000017B CurState: EXIT Event: EV_ABORT
IKEv2-PROTO-5: (282): Sent response with message id 379, Requests can be accepted from range 380 to 380
IKEv2-PROTO-5: (282): SM Trace-> SA: I_SPI=D34E003E0752B818 R_SPI=00AA509B0EC33790 (R) MsgID = 0000017B CurState: EXIT Event: EV_CHK_PENDING_ABORT
IKEv2-PROTO-5: (282): SM Trace-> SA: I_SPI=D34E003E0752B818 R_SPI=00AA509B0EC33790 (R) MsgID = 0000017B CurState: EXIT Event: EV_UPDATE_CAC_STATS
IKEv2-PROTO-2: (282): Abort exchange
IKEv2-PROTO-5: (282): Deleting negotiation context for peer message ID: 0x17b
IKEv2-PROTO-5: (282): SM Trace-> SA: I_SPI=D34E003E0752B818 R_SPI=00AA509B0EC33790 (R) MsgID = 0000017A CurState: EXIT Event: EV_FREE_NEG
IKEv2-PROTO-5: (282): Deleting negotiation context for peer message ID: 0x17a
6
  • 2
    You need to post the sanitized configs for both firewalls. It sounds like you're either missing a NAT exemption statement or you have a misconfigured ACL for which traffic is to be sent over the tunnel, but we'd need to see the configs to troubleshoot this further. – Jesse P. Mar 19 at 4:00
  • PA side? I do have ACL on Cisco ASA side and from ASA ---> PA tunnel triggers works – Satish Mar 19 at 14:41
  • 1
    Problem resolved, Issue was missing Proxy-ID on Palo Alto side. Proxy-ID trigger interesting traffic for tunnel. Now it's working, Thanks. – Satish Mar 19 at 16:37
  • Okay. You should either delete this question or post your own answer and accept it, so it doesn't keep coming up for everyone. – Jesse P. Mar 19 at 20:07
  • @JesseP. My Question is closed and not letting me answer. – Satish Mar 22 at 14:06

Browse other questions tagged or ask your own question.