Commit Operation Failure: 'IKEv2 gateway X should use the same IKE crypto profile as Y (Module: ikemgr)'

• Commit operation fails when changing IKE crypto profile for dynamic VPN gateways
• Firewall displays an error requiring identical IKE crypto profiles across multiple dynamic IKEv2 gateways
• Affected IKE gateways are configured on the same interface or local IP address
• Affected IKE gateways have their Peer IP Address Type set to Dynamic
• Affected IKE gateways use IKEv2 (or IKEv1 Main Mode)

• PAN-OS
• IPsec tunnel
• IKEv2 gateway
• IKE Crypto Profile
• Dynamic Peer Configuration

The firewall depicted in this article has been configured with 2 gateways: ike_gw_1 and ike_gw_2. Each of these are associated with IKE Crypto profiles: ike_crypto_1 and ike_crypto_2 respectively. These gateways are configured with the same interface; and each gateway is used in the configuration of 2 IPsec tunnels.

Starting in PAN-OS versions 10.1.14, 10.2.8 11.0.4,11.1.3, and all later releases, a new logic was introduced a check for IKE Crypto profile match on all gateways configured with a Dynamic Peer IP Address Type when the gateways are associated with IPsec tunnels that terminate on the same interface. In other words, the crypto profile parameters such as encryption and authentication are required to match for dynamic tunnels that terminate on the same interface.

Generally speaking, when the initial IKE_AUTH packet arrives on the interface, the firewall has to ascertain the legitimacy of the source of the packet; and it does this by employing the defined profile to decrypt the packet in order to extract authentication objects such as keyID information, etc. The implication is that if multiple profiles exists for dynamic peers terminating on the same interface, PAN-OS wouldn't know which profile to use. The code is not designed to recurse through all profiles if one of the profile fails to decrypt the packet. This minimizes brute force attempts, and also optimizes processor cycles that would otherwise be expended at recursing through every profile for large scale IPsec/VPN deployments. 

Apply the same crypto profile to all dynamic tunnels that terminate on the same interface.

In earlier PAN-OS releases, this check was not enforced; hence if the firewall is upgraded while configured with mismatched profiles, the system will encounter commit validation failure.