IPSec Tunnel Will Not Come Up with Tunneled traffic dropped due to Encapsulation Error
20204
Created On 07/11/22 00:55 AM - Last Modified 12/15/22 20:19 PM
Symptom
- IPSec Tunnel will not come up and tunneled traffic is being dropped due to encapsulation error
- Phase1 is failing
- There are no IKE/ISAKMP packets initiated by the firewall towards peer
- Global Counters shows encapsulation error as shown below while filtering for tunneled traffic
flow_tunnel_encap_err 1 1 drop flow tunnel Packet dropped: tunnel encapsulation error
- Testing vpn gateway from cli returns message "SA test initiate ignored: cannot find tunnel configuration." in ikemgr.log as shown example below
> test vpn ike-sa gateway <GATEWAY>
<DATE> [INFO]: { 3: }: <GATEWAY>: IKEv2 SA test initiate ignored: cannot find tunnel configuration
- Flow basic debug shows interesting packet dropped due to tunnel resolution failure
Packet enters tunnel encap stage, tunnel interface null Resolving tunnels in multi-tunnel case for ifp:tunnel.x <-------- x is the associated tunnel interface Packet dropped, tunnel resolution failure
Environment
- Next Generation Firewall
- PAN-OS 10.1.5, 10.1.6
- IPSec configured and terminating on another Next Generation Firewall
Cause
IPSec Tunnel configuration is disabled even though it appears to be enabled from WebUI
To confirm if its disabled run the following command
admin@firewall(active)> configure
admin@firewall(active)# show network tunnel ipsec ShapeTX_AWS_Tunnel
tunnel-interface tunnel.1;
disabled yes; <-------------------- DISABLED
comment "Left IPSEC tunnel to AWS";Resolution
Enable IPSec Tunnel configuration from either WebUI or CLI
From WebUI:
- From Network > IPSec Tunnels > select the IPSec Tunnel configuration
- Select Enable
- Commit Changes
From CLI:
> configure Entering configuration mode # set network tunnel ipsec <Name of IPSec Tunnel> disabled no # commit