topic PANOS 10.2.8 NOT recommended: S2S VPN IKEv1, IKEv2 Prefered does not work anymore in Next-Generation Firewall Discussions

PANOS 10.2.8 NOT recommended: S2S VPN IKEv1, IKEv2 Prefered does not work anymore

FabioHufschmid — Wed, 20 Mar 2024 06:01:30 GMT

Hi Everybody,

We updated from 10.2.7 to 10.2.8 and had a lot of troubles with our Site-2-Site IKEv1, IKEv2 Prefered gateway connections. I'm not sure if the IKE Version is the root problem, but that was the pattern that was visible in the short time for this change.

Phase 1 came not up, initiated in both directions.

There are the msg in the logs:

Us-2-endpoint: 'IKE phase-1 negotiation is failed as responder, main mode. Failed SA:

Endpoint-2-us: the logs said always "Connection Timeout".

Sophos, FritzBox and Azure were the other endpoints, we were not able to etablish phase 1. After Downgrading to 10.2.7 everything worked, also with 10.2.7-h3 is everything working.

We did not seen in the traffic monitor any traffic for the phase1, although we otherwise saw this connection traffic in an intrazone (Untrust-2-Untrust) rule. With PANOS 10.2.7 and H3 it was visible again

Also without Zone Protection, the connection came not up, it was like something was blocking the connection, without generating logs.

I didn't find something in the release notes that point to this issue. Somebody else with this experience?

Happy firewalling

Re: PANOS 10.2.8 NOT recommended: S2S VPN IKEv1, IKEv2 Prefered does not work anymore

MILAVITSA — Wed, 17 Apr 2024 10:03:28 GMT

There are two NAT rules (destination-translation) for the Exchange2019 mail server, starting from version 1.2.8 they stopped working. They work for some time, then they are blocked, there is no information in the logs.

In version 1.2.9 the same thing.

Re: PANOS 10.2.8 NOT recommended: S2S VPN IKEv1, IKEv2 Prefered does not work anymore

JayGolf — Wed, 24 Apr 2024 02:04:03 GMT

Thanks for providing valuable insight @FabioHufschmid ! If you ever have the time, please open up a support ticket and share details of your findings.