topic Re: Cisco ASA PA ipsec issue in General Topics

Cisco ASA PA ipsec issue

ITforacompany — Sun, 13 Mar 2022 20:51:59 GMT

Hi,

We have recently come across an interesting issue between a Cisco ASA ikev2 tunnel with a PA.

If I was to failover the PA to an HA peer, traffic initiated from the Cisco ASA continues to flow whilst traffic initiating from the PA stops.

I noticed when the PA fails over the ASA drops both phases and recreates them with a new SPI value whilst the PA continues to use the same SPA value. PA manages to change its SPA value to match the new SPI value only for traffic that originates from the ASA although traffic from the PA continues to use the same SPA value which causes the traffic to not be sent.

My fix currently is by resetting the problematic proxy ID's from PA.

I have a case open with PA although has anyone come across this before as I assume this would be a common problem faced.

Cisco ASA 9.8.4.xx, PA 10.1.4-h4

Re: Cisco ASA PA ipsec issue

TomYoung — Tue, 15 Mar 2022 00:06:28 GMT

Hi @ITforacompany ,

Have you configured Liveness Check under Network > Network Profiles > IKE Gateways > [edit gateway] > Advanced Options? I have that set to 5 seconds on an IPsec tunnel to an FTD device which is has much of the same code as an ASA. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClgcCAC

The ASA may need the "crypto ikev2 dpd interval retry-interval" command configured. I can't remember if it is default.

Thanks,

Tom

Re: Cisco ASA PA ipsec issue

ITforacompany — Tue, 15 Mar 2022 03:23:25 GMT

Hi Tom,

Appreciate the reply although the liveness check on the PA's and the DPD on the ASA is already configured.

They are different values where the PA is 5seconds and the ASA is 10seconds retry every 2 although i would not think this would be the issue.

Thanks

Re: Cisco ASA PA ipsec issue

ITforacompany — Tue, 15 Mar 2022 19:19:36 GMT

Hi Tom,

Are you using route or policy based routing for your site to site tunnels between the PA and FTD?

Re: Cisco ASA PA ipsec issue

TomYoung — Mon, 21 Mar 2022 18:45:44 GMT

Hi @ITforacompany ,

Mine is still proxy-based.

Thanks,

Tom

Re: Cisco ASA PA ipsec issue

bmartinsmm — Tue, 23 Aug 2022 14:21:23 GMT

Did PA ever get back to you on the case you opened or did you ever get a fix? I feel I'm having the very same issue you describe.

Re: Cisco ASA PA ipsec issue

ITforacompany — Tue, 23 Aug 2022 20:02:49 GMT

They did and it was drawn out. They deem this issue is just between Cisco ASA's and PA's. All other parties are not affected although yet to be tested.

Their reply to CASE 02120653

"The root of this problem is due to IKE phase 1 SA information NOT synchronized between the Palo Alto Networks HA firewalls (only IPSEC phase 2 SAs are synchronized between HA firewalls)."

Their initial answer was to disable the liveness check and DPD which after failing over the PA pairs did work although the issue arose again when the ASA rekeyed. The traffic dropped again for the proxy ID traffic that was originating behind the PA. This is due to the phase 1 details not being syncing between the HA pairs. The only fix at the moment is to manually run "test vpn ipsec-sa" from PA.

I am pushing our account rep to add it as a hotfix.

Re: Cisco ASA PA ipsec issue

bmartinsmm — Tue, 23 Aug 2022 20:51:28 GMT

Wow....thank you for the reply. Hopefully they will add it.

Re: Cisco ASA PA ipsec issue

Mr.Hilmi — Tue, 09 Jan 2024 05:38:03 GMT

Hi, I got similar issue here. Any update from your side?