In a nutshell, we're trying to stand up a Classic route based IPSec tunnel between GCP VPN and Zscaler's ZEN (Zscaler Enforcement Node). Thus far we've been unable to establish successful phase 2 handshake regardless of IKEv1 or v2 cipher used. After looking at logs provided by Zscaler support pulled from the ZEN (remote peer), it looks like it's having trouble with the generic proposal sent by our GCP cloud VPN peer. According to Zscaler's documentation; they support all default settings used by GCP VPN for both IKEv1 & v2 (encryption integrity, mode, hash, DH, and lifetime), although they do indicate preferential settings within their documentation. According to the response from Zscaler support, they require a separate subscription for phase 2 AES encryption. They've inquired about the possibility of us configuring the GCP cloud VPN peer to send a NULL phase 2 proposal, however there are no specific configurable options for either cipher type within GCP classic cloud VPN. Has anyone encountered a similar situation between Zscaler and GCP regarding IPSec negotiation, and do you have any recommendations aside from purchasing the phase 2 AES encryption service from Zscaler? Thanks in advance for any recommendations and/or insights you can provide!
Unable to establish IPSec tunnel between GCP VPN (Classic) and Zscaler ZEN (Zscaler Enforcement Node)
718 Views Asked by Christopher Landolfi At
1
There are 1 best solutions below
Related Questions in NETWORKING
- kernel module does not print packet info
- Packet drops in multicast when multiple instance of listner are running
- Timing packets on a traffic server
- How to use Espresso Idling Resource for network calls
- Dummynet does not match on flows
- Sending a notification from OS X to iOS
- Swift ios viewDidLoad or viewDidAppear
- Update player list on all clients on new connection
- Issues regarding multiplayer networking: input
- nmap does not show all open ports
- Getting and Sending Data between a Server and Client
- Read file from local PC from network deployed app to InputStream
- Does iOS block a URL if we couldn't connect to the URL for 'n' times?
- Is Socket.Available guaranteed to throw a SocketException on disconnect?
- android out of cell service
Related Questions in GOOGLE-CLOUD-PLATFORM
- Google Logging API - What service name to use when writing entries from non-Google application?
- Custom exception message from google endpoints exception
- Unable to connect database of lamp instance from servlet running on tomcat instance of google cloud
- How to launch a Jar file using Spark on hadoop
- Google Cloud Bigtable Durability/Availability Guarantees
- How do I add a startup script to an existing VM from the developer console?
- What is the difference between an Instance and an Instance group
- How do i change files using ftp in google cloud?
- How to update all machines in an instance group on Google Cloud Platform?
- Setting up freeswitch server on Google cloud compute
- Google Cloud Endpoints: verifyToken: Signature length not correct
- Google Cloud BigTable connection setup time
- How GCE HTTP Cross-Region Load Balancing implemented
- Google Cloud Bigtable compression
- Google cloud SDK code to execute via cron
Related Questions in VPN
- VPN + WPF Application
- how to spoof location so google autocomplete API will provide local results, ideally with R
- Android VpnService with multiple addresses and routes?
- Getting a list of installed VPN Profiles Programatically - iOS
- How to change connection to Cassandra on Windows and make it remote?
- batch file to automatically connect to vpn connection
- Number of nodes appears 0 in a swarm cluster
- Gitlab: can't SSH from home (Windows)
- Is it possible to a VM be "shared" by 2 or more virtual networks on Azure?
- Android WebView: cannot access site through VPN when using emulator
- Remove Helper Tool using NSTask in MAC Application
- Not receiving the sip call using VPN in my application
- How to send all traffic over a VPN connection?
- How to both read and write from a TAP device connected to a MACVLAN via a bridge?
- Get-AzureSubscription -ExtendedDetails in PowerShell doesn't include certificate
Related Questions in IPSEC
- Azure VPN connection and public IP
- Can't show ip xfrm policy and state in android device?
- Does an IPSec tunnel encrypt the destination IP address?
- IPSec vs OpenSSL vs PGP
- IPSec NAT traversal
- IPsec and racoon, custom function
- What's the point of using L2TP together with IPSec?
- How implement Ip in Udp encapsulating application?
- Getting error while configuration IKE/Ipsec connection between windows10 and SUSE Sles 12
- How to block all but a specific list of IP addresses on a given port using IPSEC on Windows?
- MAC OS X VPN client / Certificates / Cisco ASA series
- How to call built-in api l2tp/ipsec on mac osx by application
- Openswan tunnel not working after network restart
- should you authenticate the initialization vector in ipsec?
- IPsec in Linux kernel - how to figure out what's going on
Related Questions in ZSCALER
- Zscaler API Example Code
- ECONNREFUSED 127.0.0.1:9000 on OmniSharp install in Visual Studio Code on WSL2 behind corporate cloud proxy
- ServiceUnavailable: 503 failed. Ssl handshake failed: SSL_ERROR_SSL: error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED
- Cannot build docker image with Zscaler
- Cannot attach an existing OS disk if the VM is created from a platform, user or a shared galley image Azure
- Office add-in sometimes won't load and instead opens webpage
- How to add ZScaler certificate to edgeHub and edgeAgent?
- RestSharp issues integrating with zscaler product will not work on IIS Server 2012 R2
- Making HTTPS requests within a Docker image behind a Zscaler firewall
- upload file to ftp server over http proxy using php/curl stopped by zscaler
- Duplicated and unauthenticated requests from users from a corporation using Zscaler for authentication
- curl: (60) SSL certificate problem: when uploading behind proxy
- Unable to establish IPSec tunnel between GCP VPN (Classic) and Zscaler ZEN (Zscaler Enforcement Node)
- Authenticate proxy in Python Selenium (zscalar)
- conda: pip fails in venv due to SSL verification problems - how to make it work as in base environment
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
Thanks again John for your insights and help! I suppose the answer was right there all along to begin with, and I simply refused to see it lol. It also led me to understand why our attempts to establish a tunnel using IKEv2 failed as well - GCP VPN sends their generic proposal, with the intention of conforming to cipher settings received from the remote peer. In situations where the remote peer utilizes a generic proposal as well, GCP VPN chooses a 'best fit' based on the hardware vendor ID sent by the remote peer. In this situation the Zscaler Enforcement Node (ZEN) remote peer responds with an unknown vendor ID which, possibly due to it being their own proprietary unregistered platform. If it's not inclusive to GCP VPN's list of known hardware vendor IDs, it explains why the GCP peer responds stating unidentified remote peer proposal.
Nonetheless, thanks again for all your help!