IPSec Diffie Hellman group DH20 issues?

triJRO

Hi,

I'm currently trying to establish a IPSec VPN tunnel with my USG Flex 500 (
V5.36(ABUJ.2)) to a Palo Alto firewall to a customer. The settings do match between us but the connection can't be established. The debugging from customer side indicates that the Palo Alto uses ID 20 but from my side it reports ID 12 which doesn't exist although ID 20 is configured. Are there any known issues with using newer DH groups like 20 or 21?

Zyxel_Cooldia

Hi @triJRO ,

DH group 20 works in my lab test, can you send me IKE communication packets in PM.

We would like to check ISAKMP SA payload