VPIPSEC VPN PROBLEM

[OSSATR]

Hi, I'm trying to configure a VPN tunnel between FortiGate and Palo Alto. Phase 1 is successful, but the VPN tunnel is not coming up. After diagnosing the issue, I found this problem:

ike 0:T-VPN X:12737: out 636683CBD27BF67700000000000000002120220800000000000001AC2200005C0200002C010100040300000C0100000C800E010003000008020000020300000803000002000000080400000E0000002C020100040300000C0100000C800E01000300000802000005030000080300000C000000080400000E28000108000E0000B8790CEC9BFDC31B0F762FA7CB120D169EDD571D1757312098873945ACACFE915F191029EB5B54348D28A2082E0DA8E089E737365ADFC4AD04666130400EF8005A1D984C42B5807F4CAC7D6585A7EA1D0E78A8179E475CE34C4BF72C81C0995CDF3E6E19EB88A80280F8BDEB5C6FA1C76799529FC53353A36020760F02A7E57D4B825283F45F8C9F13B331109703827E0B5CE1883C65F9CC845888583B83918334FA1F9123B197769CD78D06867D0B19C716EB4130D78F06EF1854FEE82C794D9C4871335B5F84D792A441330780A64FD0601B62EAB1F2652C95D91F87ECD18D61982529F9283CF4E30D2F80857FE9534C995A1D47BCA4D4F4F5E9EA6DB09F1A29000024BB84B7A9F56403EA4490792EF60D18BF5F2D21FEA18893B5B9F0BAA0779B4439000000080000402E
ike V=root:0:T-VPN X:12737: sent IKE msg (RETRANSMIT_SA_INIT): A.A.A.A:500->B.B.B.B:500, len=428, vrf=0, id=636683cbd27bf677/0000000000000000, oif=16
ike V=root:0:T-VPN X:T-VPN X: IPsec SA connect 16 A.A.A.A-->B.B.B.B:0
ike V=root:0:T-VPN X:T-VPN X: using existing connection
ike V=root:0:T-VPN MX:T-VPN X: config found
ike V=root:0:T-VPN X: request is on the queue
ike V=root:0:T-VPN X:T-VPN X: IPsec SA connect 16 A.A.A.A-->B.B.B.B:0
ike V=root:0:T-VPN X:T-VPN X: using existing connection
ike V=root:0:T-VPN X:T-VPN X: config found
ike V=root:0:T-VPN X: request is on the queue
ike V=root:0:T-VPN X:T-VPN X: IPsec SA connect 16 A.A.A.A-->B.B.B.B:0
ike V=root:0:T-VPN X:T-VPN X: using existing connection
ike V=root:0:T-VPN X:T-VPN X: config found
ike V=root:0:T-VPN X: request is on the queue

A.A.A.A is the Ip address of my wan interface and B.B.B.B is the public ip address for the palo alto side.

[ozkanaltas]

Hello @OSSATR ,

I saw a private IP(192.168.55.12) in the logs. Did you enable nat-traversal mutually?

If your firewall is behind the nat device(router, modem, etc.), you need to use nat-t on ipsec configuration.

[ede_pfau]

The FGT sent packets out to UDP/500 which are not answered. This indicates that NAT traversal (NAT-T) is not active on the PA side, as @ozkanaltas pointed out as well.

My guess is that A.A.A.A is 192.168.55.12, and you overlooked one occasion. Which is good in this case. Completely hiding IP addresses might obscure the root cause - next time, try to only hide public IPs so that a reader can distinguish between private and public addresses while not giving away valuable info.