Difficult VPN connection with IPsec

[Guest]

[ricardo.claus]

Hello guys,
I'm having trouble closing a Lan-to-LAN VPN connection with IPsec.

My scenery:
Endian 3.2 Community which is the gateway of my network, connecting to a remote IPsec server, Palo Alto UTM.

My Endian could not connect.
I need to release some output port for IPsec to connect?
I released the doors 50, 51 and 500.
Strange is that in the firewall log, I do not see any connection going out to the remote IP. Is it correct that the IPsec outgoing connection does not appear in the firewall log?

The following is the IPsec log:

Every 1.0s: ipsec statusall                                                                                                                                                                                                                           Thu Aug 24 16:28:39 2017

Status of IKE charon daemon (weakSwan 5.3.5, Linux 4.1.35.e13.1, x86_64):
  uptime: 111 minutes, since Aug 24 14:37:39 2017
  malloc: sbrk 2723840, mmap 0, used 473600, free 2250240
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 1
  loaded plugins: charon ldap aes des blowfish rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem fips-prf gmp agent xcbc cmac hmac curl attr kernel-netlink resolve socket-default farp stroke updown eap-i
dentity eap-sim eap-aka eap-aka-3gpp2 eap-simaka-pseudonym eap-simaka-reauth eap-md5 eap-gtc eap-mschapv2 eap-radius xauth-generic xauth-pam dhcp lookip addrblock
Listening IP addresses:
  IPWAN
  IPLAN

Connections:
  vpnremoto:  IPWAN...IPREMOTE  IKEv1, dpddelay=30s
  vpnremoto:   local:  [vpnlocal] uses pre-shared key authentication
  vpnremoto:   remote: [vpnremoto] uses pre-shared key authentication
  vpnremoto:   child:  10.10.14.96/30 === 10.14.11.40/32 TUNNEL, dpdaction=clear
Security Associations (0 up, 1 connecting):
  vpnremoto[5]: CONNECTING, MY IPWAN [vpnlocal]...IPREMOTE[%any]
  vpnremoto[5]: IKEv1 SPIs: 553fd867b9f3a47e_i* aa3664da7e01e79a_r
  vpnremoto[5]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536
  vpnremoto[5]: Tasks queued: QUICK_MODE
  vpnremoto[5]: Tasks active: ISAKMP_VENDOR MAIN_MODE

[Dark-Vex]

Hi, you don't need to open any ports on the outgoing firewall, because the connections generated by the firewall are always allowed. On the router (if filter the outgoing traffic) you need to open the port UDP 500 and UDP 4500
Check the ipsec logs under /var/log/ipsec/ipsec.log for errors