topic Re: Palo Alto troubleshooting tool for IPsec in General Topics

Palo Alto troubleshooting tool for IPsec

didier.bonato — Thu, 16 Dec 2021 08:34:34 GMT

Hello

I established an Ipsec tunnel (policy based) between palo Alto and Cisco FW.

phase 1 & phase 2 are up and running but trying to transfer data, fail.

Capture packet (merge recieved and transmit) shown

Source : SYN

Dest : SYN ACK

And then Dest : retransmit SYN ACK.

If this capture is within transmit pcap, this mean the re transmission packet have been forwarded into the IPSEC Tunnel (egress interface) ?

Previoulsy, I was working with Checkpoint and able to use command line FW MONITOR to know if my packet was forward/encrypted to the tunnel. (this mean problem is located on FW itself or after the FW.

Is it a tool that permitting to know if this SYN ACK packet is forwarded into Interface tunnel or not ?

Regards

Re: Palo Alto troubleshooting tool for IPsec

OtakarKlier — Thu, 16 Dec 2021 22:29:02 GMT

Hello,

Check the traffic logs to see why the traffic is getting blocked. Before this make sure you enable logging on your security policies. This should tell you where and why the traffic is getting blocked.

Security policy basics:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClWZCA0

Could also be routing, make sure you put the destination subnet into your virtual router and point the destination at the tunnel.

Hope this helps.

Re: Palo Alto troubleshooting tool for IPsec

didier.bonato — Fri, 17 Dec 2021 07:36:15 GMT

Thanks for your reply,

Anyway, I don't have traffic blocked in logs (allowed but aged out), and the tcp handshake start with SYN and ACK, this mean not blocked.

I was suspecting routing issue, that's why (even the route is set as static route) I would like to know how to be sure, this ACK reply has been properly "pushed" to my tunnel interface?

Regards

Re: Palo Alto troubleshooting tool for IPsec

OtakarKlier — Fri, 17 Dec 2021 16:55:36 GMT

Hello,

To check routing click the Networking tab at the top ->Virtual routers -> More Runtime Stats

Then look for a subnet that is on the Cisco side of the tunnel, then make sure it points to the tunnel.

Regards,

Re: Palo Alto troubleshooting tool for IPsec

OtakarKlier — Fri, 17 Dec 2021 19:10:14 GMT

Hello,

Also here are some additional articles that have additional information.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clh5CAC

Regards,

Re: Palo Alto troubleshooting tool for IPsec

KarD5d — Sat, 18 Dec 2021 20:07:59 GMT

I had the same issue with failing Data transfer, however i found this discussion and thanks for your helpful articles links, I manage my issue, waiting more useful discussion about Ipsec tunnel.

Re: Palo Alto troubleshooting tool for IPsec

OtakarKlier — Mon, 20 Dec 2021 20:53:26 GMT

Hello,

Glad you found it useful. Always feel free to post any questions.

Cheers!