topic Re: unknown ikev2 peer - PA1420 running PAN-OS 11.0.1-h1 in Next-Generation Firewall Discussions

unknown ikev2 peer - PA1420 running PAN-OS 11.0.1-h1

Manu_P — Wed, 01 Nov 2023 12:55:10 GMT

So, i have this type of errors in my logs and i really dont know how to tackle them.

No other info, like for example who is the peer that generates this event, like i used to get on an older PA device also running an older PANOS version

Any ideas?

Re: unknown ikev2 peer - PA1420 running PAN-OS 11.0.1-h1

Raido_Rattameister — Wed, 01 Nov 2023 17:33:38 GMT

You will get rid of noise coming from internet by permitting incoming VPN only from your peer IPs.

To figure out what IP is trying to connect you need to look into ikemgr.log log by using commands below

less mp-log ikemgr.log

tail follow yes mp-log ikemgr.log (updates log output in real time)

Re: unknown ikev2 peer - PA1420 running PAN-OS 11.0.1-h1

Manu_P — Thu, 02 Nov 2023 09:54:55 GMT

Thanks, that did it (not doing much ike troubleshooting so i forgot about that log)

Still, i wished PanOS to display that info in the system monitor logs

Anyway, you said this:

"You will get rid of noise coming from internet by permitting incoming VPN only from your peer IPs"

How? i did not set an explicit rule to allow incoming vpn - i assumed the firewall did that behind the scene

Or do you mean to setup an explicit deny all incoming ike rule, with exception for an address group containing all my ike-gateways-ip-addresses?

Re: unknown ikev2 peer - PA1420 running PAN-OS 11.0.1-h1

Raido_Rattameister — Thu, 02 Nov 2023 12:23:33 GMT

You can add security policy

Source zone - WAN

Destination zone - WAN

Source IP - Your and your peer IPs that terminate IPSec

Destination IP - Your and your peer IPs that terminate IPSec

Application - ipsec

And at the end of the ruleset "block any" rule.

IPSec works because of "intrazone-default" rule permitting same zone traffic.

Be careful when you add "block any" rule because you might have other traffic relying on this intrazone-default rule.