Azure Palo Alto S2S in Not Connected State

test 0 Reputation points
2024-04-17T11:43:06.75+00:00

IKEDiagnosticLog Throws these errors.

No Phase2 qms left on active connection

The parameter is incorrect.

Sending IKE SA delete for icookie

I have a EgressNat rule attached as well Screenshot 2024-04-17 at 4.08.11 PM
Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,529 questions
Azure Startups
Azure Startups
Azure: A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.Startups: Companies that are in their initial stages of business and typically developing a business model and seeking financing.
258 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee
    2024-04-18T14:21:47.25+00:00

    Hello @test ,

    Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

    I understand that you are trying to setup a site-to-site VPN connection between Azure and your on-premises Palo Alto device, but it shows Not connected.

    Since the protocol on the above screenshot shows IKEv2, I believe you are using a Route-based VPN gateway.

    Could you please share the below details:

    • What is your Palo Alto device or PAN-OS version?
    • You also mentioned that you've an EgressNat rule attached as well, do you have address space overlap between Azure and your on-premises?

    When the on-premises network address space overlaps with the virtual network address space, you need both Ingress and Egress rules on the same connection.

    Refer: https://video2.skills-academy.com/en-us/azure/vpn-gateway/nat-overview#do-i-need-both-ingress-and-egress-rules-on-a-nat-connection

    The error "No Phase2 qms left on active connection" comes up when on-premises VPN device sends the IKEV2_TS_UNACCEPTABLE message and the on-premises VPN device tears down the tunnel.

    So, this could mostly be a misconfiguration somewhere.

    I would request you to validate your configuration again following the below document:

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm6WCAS

    And if the above doesn't help, please share the above requested details for further discussion on this issue.

    Kindly let us know if the above helps or you need further assistance on this issue.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.