Examice

Exam PCNSE All QuestionsBrowse all questions from this exam

Question 180

An administrator receives the following error message:

"IKE phase-2 negotiation failed when processing Proxy ID. Received local id 192. 168.33.33/24 type IPv4 address protocol 0 port 0, received remote id

172.16.33.33/24 type IPv4 address protocol 0 port 0."

How should the administrator identify the root cause of this error message?

Verify that the IP addresses can be pinged and that routing issues are not causing the connection failure.

Check whether the VPN peer on one end is set up correctly using policy-based VPN.

In the IKE Gateway configuration, verify that the IP address for each VPN peer is accurate.

In the IPSec Crypto profile configuration, verify that PFS is either enabled on both VPN peers or disabled on both VPN peers.

Correct Answer: B

The error message indicates a failure during IKE Phase 2 negotiation due to incorrect Proxy IDs. This is typically caused by a mismatch in the VPN configuration on each end of the connection. Specifically, one end might be set up using a policy-based VPN, which requires Proxy IDs, while the other end might not be configured correctly to match this setup. Therefore, the administrator should check whether the VPN peer on one end is set up correctly using policy-based VPN to ensure that the Proxy IDs match.

Discussion

lol12Option: B

B https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/vpns/set-up-site-to-site-vpn/interpret-vpn-error-messages

TAKUM1yOption: B

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/vpns/set-up-site-to-site-vpn/interpret-vpn-error-messages

Biz90Option: B

I know this too well from dealing with ASA to PAs! Answer is B.

alanouaroOption: B

Option B The VPN peer on one end is using policy-based VPN. You must configure a Proxy ID on the Palo Alto Networks firewall. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/vpns/set-up-site-to-site-vpn/interpret-vpn-error-messages.html

Plato22Option: B

B is correct. Cisco uses Policy based which is Proxy ID in Palo Alto

MarshpillowzOption: B

B is correct

DenskyDenOption: B

B. The VPN peer on one end is using policy-based VPN. You must configure a Proxy ID on the Palo Alto Networks firewall. See Create a Proxy ID to identify the VPN peers..