Azure Palo Alto S2S in Not Connected State

test 0

IKEDiagnosticLog Throws these errors.

No Phase2 qms left on active connection

The parameter is incorrect.

Sending IKE SA delete for icookie

I have a EgressNat rule attached as well Screenshot 2024-04-17 at 4.08.11 PM

GitaraniSharma-MSFT 47,421 Reputation points Microsoft Employee

2024-04-18T14:21:47.25+00:00
Hello @test ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you are trying to setup a site-to-site VPN connection between Azure and your on-premises Palo Alto device, but it shows Not connected.

Since the protocol on the above screenshot shows IKEv2, I believe you are using a Route-based VPN gateway.

Could you please share the below details:

What is your Palo Alto device or PAN-OS version?

You also mentioned that you've an EgressNat rule attached as well, do you have address space overlap between Azure and your on-premises?

When the on-premises network address space overlaps with the virtual network address space, you need both Ingress and Egress rules on the same connection.

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/nat-overview#do-i-need-both-ingress-and-egress-rules-on-a-nat-connection

The error "No Phase2 qms left on active connection" comes up when on-premises VPN device sends the IKEV2_TS_UNACCEPTABLE message and the on-premises VPN device tears down the tunnel.

So, this could mostly be a misconfiguration somewhere.

Coud you please validate the configuration again following the below document?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm6WCAS

Regards,

Gita
GitaraniSharma-MSFT 47,421 Reputation points Microsoft Employee

2024-04-22T17:03:01.0033333+00:00

@test , could you please provide an update on this post?