Commit failure due to client ikemgr reported error when configuring new VPN tunnel

Commit failure due to client ikemgr reported error when configuring new VPN tunnel

35609
Created On 05/29/20 21:15 PM - Last Modified 07/30/26 01:45 AM


Symptom


  • Commit fails when trying to use a new IKE crypto while configuring a new VPN tunnel
  • The error message ask to use a IKE crypto from VPN-2 while configuring a new VPN-1 tunnel configuration
  • Auto-commit error after upgrade <ABC> "should use the same IKE crypto profile as" <XYZ>


Environment


  • IPSec VPN with gateway with passive mode
  • Peer configured as dynamic IP
  • Starting from PAN-OS version 10.1.14, 10.2.11, 11.0.4, 11.1.3, and 11.2.0


Resolution


All IKE gateways configured on the same interface or local IP address must use the same crypto profile when the remote IP type is configured as 'dynamic'.
This is as per design.

This issue may occur after the upgrade. To resolve it, follow the next steps: 

  1. Rollback PAN-OS to previous version.
  2. Ensure that all dynamic IKE peers configured on the same IP address and interface are using the same IKE crypto profile and commit the configuration.
  3. Upgrade the PAN-OS to the target version.


Additional Information


var/log/pan/ms.log output:

client ikemgr reported error: IKEv2 gateway Alpha-GW should use the same IKE crypto profile as VPN1-GW (IKEv2: Alpha-IKE).(Module: ikemgr)
client ikemgr reported error: IKEv2 gateway VPN1-GW should use the same IKE crypto profile as Alpha-GW (IKEv2: VPN1-IKE).(Module: ikemgr)
client ikemgr reported Phase 1 FAILED


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g0000008UErCAM&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language