IPsec Tunnel Failure Palo Alto Firewall Crypto Profile Mismatch with WSS

Products

• Cloud Secure Web Gateway - Cloud SWG
• Cloud SWG Express

Issue/Introduction

IPsec tunnels established from Palo Alto firewalls drop and fail to reconnect to the WSS.

Cause

The IPsec negotiation was rejected by the Palo Alto firewall because the configured crypto profile combined AES-CBC and AES-GCM proposals within the same profile.

The Cloud SWG preferentially selects AES-GCM, which uses a stronger encryption mechanism and does not require HMAC parameters.

However, because both AES-CBC and AES-GCM were configured in the same Palo Alto crypto profile, the firewall expected HMAC parameters for all proposals. When the WSS returned a valid AES-GCM response without HMAC parameters, the Palo Alto firewall incorrectly interpreted the response as an invalid proposal and rejected the IPsec negotiation.

Resolution

Modify the Palo Alto crypto profile to appropriately separate the AES-CBC and AES-GCM proposals.

1. Access the Palo Alto firewall configuration.
2. Navigate to the IKE Crypto Profile settings.
3. Ensure that AES-CBC and AES-GCM proposals are configured as distinct, separate profiles or handled in a way that prevents proposal parameter conflicts.
4. Once separated, the firewall will correctly negotiate the IPsec tunnel without rejecting the Concentrator’s AES-GCM proposal.