topic Re: VPN Site to site IPSec Tunnel not working in General Topics

VPN Site to site IPSec Tunnel not working

smshafek — Wed, 04 May 2022 12:41:24 GMT

Hello,

I've configured a VPN Tunnel from a PA220 to a PA200. They are able to ping each other but I don't see any ESP Packets in Wireshark. What should I do to get the packets to be encapsulated?

Many thanks in advanced.

Re: VPN Site to site IPSec Tunnel not working

PavelK — Wed, 04 May 2022 13:14:29 GMT

Thank you for the post @smshafek

if you see the ipsec tunnel up with packets being encapsulated/decapsulated and routing is set correctly to go through tunnel, there is no other extra step to do for traffic to be encapsulated. Could you please confirm how did you take packet capture? What interface did you use to capture traffic?

Kind Regards

Pavel

Re: VPN Site to site IPSec Tunnel not working

smshafek — Wed, 04 May 2022 13:37:04 GMT

Hi Pavel,

I'm capturing traffic on the two hosts. One connected to the LAN of PA220 and the other to the LAN of PA200.

Best regards

Re: VPN Site to site IPSec Tunnel not working

PavelK — Wed, 04 May 2022 13:59:31 GMT

Thank you for reply @smshafek

The ipsec tunnel between two PA Firewalls does not provide host to host end to end encryption. You will only see ESP traffic on interfaces that are used to build ipsec tunnel. This is typically WAN interface of the Firewall. You can refer to this in ike gateway configuration.

If you want to do further verification of the tunnel configuration, I would recommend to take a look into this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTbCAK Please refer to the section: "Tunnel is up but the traffic is not passing". In the output from: "show vpn flow tunnel-id <tunnel id>" the inner interface is where naked traffic comes in and outer interface is where you will only see ESP traffic.

Kind Regards

Pavel

Re: VPN Site to site IPSec Tunnel not working

smshafek — Wed, 04 May 2022 14:03:09 GMT

Hi Pavel,

I'm able to capture the traffic now. Many thanks again!