topic Request help with the exact meaning of these IPsec event alerts for Palo Alto. in Next-Generation Firewall Discussions

Request help with the exact meaning of these IPsec event alerts for Palo Alto.

Kandarp_Desai — Mon, 06 Mar 2023 08:52:17 GMT

Hello All,

I would like to know what is the meaning of the typical events we observe in the IPsec details in the monitor logs.

ikev2-nego-ike-succ

ikev2-nego-child-succ

ipsec-key-install

ikev2-nego-child-start

ikev2-nego-ike-dpd-dn

ipsec-key-delete

ikev2-nego-stale-p2

ikev2-nego-ike-succ

ipsec-key-expire

Re: Request help with the exact meaning of these IPsec event alerts for Palo Alto.

TomYoung — Tue, 07 Mar 2023 00:13:34 GMT

Hi @Kandarp_Desai ,

Most of those log messages are located here -> https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/use-syslog-for-monitoring/system-log-reference/informational-system-log-messages.

Here is a quick and dirty explanation of each:

SA = security association = separate encrypted tunnel

ikev2-nego-ike-succ = IKEv2 Phase 1 successfully negotiated

ikev2-nego-child-succ = IKEv2 Phase 2 successfully negotiated (Child SAs are typically negotiated for each subnet pair)

ipsec-key-install = encryption keys are renewed at regular intervals

ikev2-nego-child-start = a new child SA was created

ikev2-nego-ike-dpd-dn = Dead Peer Detection is down, maybe look at the timers

ipsec-key-delete = encryption keys are renewed at regular intervals

ikev2-nego-stale-p2 = Deleting a possible stale IKEv2 child SA.

ipsec-key-expire = encryption keys are renewed at regular intervals

SAs are created and deleted as needed by traffic. These logs are all normal with the exception of DPD down. However, since the severity is low, the tunnel probably stayed up. Here is an article on DPD and tunnel monitoring (2 separate technologies) -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFaCAK.

Thanks,

Tom

Re: Request help with the exact meaning of these IPsec event alerts for Palo Alto.

Kandarp_Desai — Wed, 08 Mar 2023 17:06:58 GMT

Thanks for your help Tom !!

Re: Request help with the exact meaning of these IPsec event alerts for Palo Alto.

MostafaSafari — Tue, 07 May 2024 13:35:38 GMT

@TomYoung

Hello Tom,

I have a question some how related to this post.

I am seeing a lot of events with severity of informational like the below events over and over, multiple of these events in a second.

is it normal?
ikev2-nego-child-succ
ipsec-key-install
ikev2-nego-child-start
ikev2-recv-p2-delete
ipsec-key-delete
ikev2-send-p2-delete
ikev2-nego-ike-succ
ikev2-nego-child-succ
ipsec-key-install
ikev2-nego-child-start
ikev2-nego-ike-start