Unable to establish IPSec tunnel between GCP VPN (Classic) and Zscaler ZEN (Zscaler Enforcement Node)

Question

In a nutshell, we're trying to stand up a Classic route based IPSec tunnel between GCP VPN and Zscaler's ZEN (Zscaler Enforcement Node). Thus far we've been unable to establish successful phase 2 handshake regardless of IKEv1 or v2 cipher used. After looking at logs provided by Zscaler support pulled from the ZEN (remote peer), it looks like it's having trouble with the generic proposal sent by our GCP cloud VPN peer. According to Zscaler's documentation; they support all default settings used by GCP VPN for both IKEv1 & v2 (encryption integrity, mode, hash, DH, and lifetime), although they do indicate preferential settings within their documentation. According to the response from Zscaler support, they require a separate subscription for phase 2 AES encryption. They've inquired about the possibility of us configuring the GCP cloud VPN peer to send a NULL phase 2 proposal, however there are no specific configurable options for either cipher type within GCP classic cloud VPN. Has anyone encountered a similar situation between Zscaler and GCP regarding IPSec negotiation, and do you have any recommendations aside from purchasing the phase 2 AES encryption service from Zscaler? Thanks in advance for any recommendations and/or insights you can provide!

Answer 1

Thanks again John for your insights and help! I suppose the answer was right there all along to begin with, and I simply refused to see it lol. It also led me to understand why our attempts to establish a tunnel using IKEv2 failed as well - GCP VPN sends their generic proposal, with the intention of conforming to cipher settings received from the remote peer. In situations where the remote peer utilizes a generic proposal as well, GCP VPN chooses a 'best fit' based on the hardware vendor ID sent by the remote peer. In this situation the Zscaler Enforcement Node (ZEN) remote peer responds with an unknown vendor ID which, possibly due to it being their own proprietary unregistered platform. If it's not inclusive to GCP VPN's list of known hardware vendor IDs, it explains why the GCP peer responds stating unidentified remote peer proposal.

Nonetheless, thanks again for all your help!