IPSec Tunnel Will Not Come Up with Tunneled traffic dropped due to Encapsulation Error

IPSec Tunnel Will Not Come Up with Tunneled traffic dropped due to Encapsulation Error

20204
Created On 07/11/22 00:55 AM - Last Modified 12/15/22 20:19 PM


Symptom


  • IPSec Tunnel will not come up and tunneled traffic is being dropped due to encapsulation error
  • Phase1 is failing
  • There are no IKE/ISAKMP packets initiated by the firewall towards peer
  • Global Counters shows encapsulation error as shown below while filtering for tunneled traffic
flow_tunnel_encap_err     1      1 drop     flow    tunnel    Packet dropped: tunnel encapsulation error
  • Testing vpn gateway from cli returns message "SA test initiate ignored: cannot find tunnel configuration." in ikemgr.log as shown example below
> test vpn ike-sa gateway <GATEWAY>
<DATE>  [INFO]: {    3:     }: <GATEWAY>: IKEv2 SA test initiate ignored: cannot find tunnel configuration
  • Flow basic debug shows interesting packet dropped due to tunnel resolution failure
Packet enters tunnel encap stage, tunnel interface null
Resolving tunnels in multi-tunnel case for ifp:tunnel.x   <--------  x is the associated tunnel interface
Packet dropped, tunnel resolution failure


Environment


  • Next Generation Firewall
  • PAN-OS 10.1.5, 10.1.6 
  • IPSec configured and terminating on another Next Generation Firewall


Cause


IPSec Tunnel configuration is disabled even though it appears to be enabled from WebUI

To confirm if its disabled run the following command
admin@firewall(active)> configure
admin@firewall(active)# show network tunnel ipsec ShapeTX_AWS_Tunnel
  tunnel-interface tunnel.1;
  disabled yes;                                        <-------------------- DISABLED
  comment "Left IPSEC tunnel to AWS";


Resolution


Enable IPSec Tunnel configuration from either WebUI or CLI

From WebUI:
  1. From Network > IPSec Tunnels >  select the IPSec Tunnel configuration 
ipsec11.PNG
  1. Select Enable 
enable22.PNG
  1. Commit Changes


From CLI:
> configure
Entering configuration mode
# set network tunnel ipsec <Name of IPSec Tunnel> disabled no
# commit


 


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkukCAA&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language