topic Re: IPSec from Palo Alto firewall to Harmony Connect in SASE and Remote Access

IPSec from Palo Alto firewall to Harmony Connect

jdoe1979 — Wed, 10 May 2023 23:09:23 GMT

Is there a guide to connect Palo Alto device as branch to Harmony Connect?

I got one configured yet it won't connect despite following the instructions provided by Harmony Connect

Blade: VPN

Action: Reject

More Status:

Main Mode Failed to match proposal: Transform: AES-256, SHA1, Pre-shared secret, Group 2 (1024 bit); Reason: Wrong value for: Key Length

Reject Category:

IKE failure

On Palo end it fails with
'IKE phase-1 negotiation is failed as initiator, main mode. Failed SA: x.x.x.x[500]-x.x.x.x[500] cookie:7850fef71849de60:0000000000000000. Due to timeout.

Re: IPSec from Palo Alto firewall to Harmony Connect

the_rock — Wed, 10 May 2023 23:47:36 GMT

Message clearly indicated phase 1 IKE failure. Did you confirm all settings match? What guide did you follow?

Andy

Re: IPSec from Palo Alto firewall to Harmony Connect

jdoe1979 — Thu, 11 May 2023 20:29:27 GMT

There's no guide from Harmony Connect for Palo Alto NGFW. I used the parameters from UI to configure ike/ipsec options.