PSE-PLATFORM · Question #237
After Migrating from an ASA firewall to a Palo Alto Networks Firewall, the VPN connection between a remote network and the Palo Alto Networks Firewall is not establishing correctly. The following…
The correct answer is D. Update the IPSec Crypto profile for the Vendor IPSec Tunnel from no-pfs to group2. Reading the log entry is the key: my:0 means the Palo Alto firewall is configured with no-pfs (group 0), while peer:2 means the remote peer requires PFS group 2. Option D correctly resolves this by updating the IPSec Crypto profile (Phase 2) to change from no-pfs to group2…
Question
After Migrating from an ASA firewall to a Palo Alto Networks Firewall, the VPN connection between a remote network and the Palo Alto Networks Firewall is not establishing correctly. The following entry is appearing in the logs:
Pfs group mismatched: my:0 peer:2 Which setting should be changed on the Palo Alto Networks Firewall to resolve this error message?
Options
- AUpdate- the IPSec Crypto profile for the Vendor IPSec Tunnel from group2 to no-pfs.
- BUpdate the IKE Crypto profile for the Vendor IKE gateway from no pfs to group2.
- CUpdate the IKE Crypto profile for the Vendor IKE gateway from group2 to no pfs
- DUpdate the IPSec Crypto profile for the Vendor IPSec Tunnel from no-pfs to group2.
How the community answered
(29 responses)- A3% (1)
- B7% (2)
- C7% (2)
- D83% (24)
Explanation
Reading the log entry is the key: my:0 means the Palo Alto firewall is configured with no-pfs (group 0), while peer:2 means the remote peer requires PFS group 2. Option D correctly resolves this by updating the IPSec Crypto profile (Phase 2) to change from no-pfs to group2, making both sides match.
Why the distractors fail:
- A goes the wrong direction - changing group2 → no-pfs would only be correct if the log showed
my:2 peer:0. - B and C target the IKE Crypto profile (Phase 1/key exchange), but PFS is a Phase 2 (IPSec) setting - IKE profiles don't control PFS group negotiation.
Memory tip: Use the phrase "PFS lives in Phase 2" - PFS (Perfect Forward Secrecy) belongs to the IPSec crypto profile, not IKE. And always read the log literally: my = your firewall's current setting, peer = what the other side expects. Change your side to match the peer.
Topics
Community Discussion
No community discussion yet for this question.