topic Re: duplicate ipsec tunnels in General Topics

duplicate ipsec tunnels

SergioLopez1 — Thu, 05 May 2022 15:56:34 GMT

Hello Comunity,

I have a weird issue, we upgrade a cluster to 10.1.5-h1 from a 9.1 version, after the upgrade on the gui i see all the ipsec tunnels duplicated for example i had an ipsec tunnel called vpn_consult, after the upgrade i had 2 ipsec tunnels called vpn_consult, all the tunnels are working, and in the merge-running-config.xml, i see all the tunnels ok, so, no double entries on the config xml.

someone have see this problem?

Re: duplicate ipsec tunnels

reaper — Thu, 05 May 2022 16:33:52 GMT

See if resetting your gui helps:

Https://<your firewall>/debug

Re: duplicate ipsec tunnels

SergioLopez1 — Thu, 05 May 2022 16:42:38 GMT

how reset GUI, just entering to that URL?

Re: duplicate ipsec tunnels

SARowe_NZ — Tue, 10 May 2022 10:36:01 GMT

Yeah I get this too. It is a graphic issue only as the duplicates do not appear in the CLI, and are true duplicates which is not possible under config validation.

I manage multiple different customer environments and it seems to have on upgrade to 10.0 or 10.1 (I have not tested 10.2). It has happened consistently on every upgrade I've done. All of these are panorama managed and the tunnels show one Panorama inherited tunnel (correct) and a duplicate copy of the same as firewall local (incorrect).

If any one finds a way to fix it please let us know as it is annoying and confusing to customers.

Re: duplicate ipsec tunnels

SARowe_NZ — Tue, 10 May 2022 10:44:58 GMT

Forgot to mention that it also appears in Panorama. The template shows a single copy of the VPN, however the Template stack shows 2 copies of all tunnels (all of them coming from the same Template which only has a single copy).

Weird bug.

Re: duplicate ipsec tunnels

SergioLopez1 — Tue, 10 May 2022 12:48:05 GMT

I found this on a reddit forum, it looks like someone encounter the same, but i couldnt find this PAN-191466 code to confirm it

"This problem is being cause by a recently discovered issue called PAN-191466. From what I read in our internal database of Panorama issues, this problems started in Panorama 10.1.5 and has not been resolved yet. There were no workarounds listed, but I would assume that going to 10.1.4 or earlier would fix the issue, but I cannot verify this. The future Release Notes will announce when this issue is resolved. Below is some information on this issue."

* The Panorama override option is not available in the template stack to modify the IPSec tunnel settings after the Panorama 10.1.5 upgrade.

* Duplicate IPSec tunnel objects gets created on Firewall/Panorama (Template-stack) WebUI after upgrading after the Panorama 10.1.5 upgrade.

Re: duplicate ipsec tunnels

InternationalMaritime — Sun, 15 May 2022 14:23:49 GMT

We faced the same issue after upgrading from 10.0.7 to 10.1.5-h1.

Any recommendation to fix this yet..?

Re: duplicate ipsec tunnels

SergioLopez1 — Tue, 17 May 2022 10:14:48 GMT

it looks like it will be fix on 10.1.6, but still no confirmation or the error code been public on the palo alto. At least they should public the bug

Re: duplicate ipsec tunnels

SCALTEL_SLS — Wed, 01 Jun 2022 13:52:35 GMT

Hello, has anyone had the opportunity to test the 10.1.6 and check if it was fixed there?

Re: duplicate ipsec tunnels

ajezierski — Thu, 09 Jun 2022 18:35:41 GMT

I can confirm the duplicate tunnels & no override available is fixed in 10.1.6

Re: duplicate ipsec tunnels

ntravis — Thu, 23 Jun 2022 19:54:43 GMT

10.1.6 resolved this for me as well.

Re: duplicate ipsec tunnels

Ezhilarasan — Fri, 28 Oct 2022 05:45:32 GMT

Anyone share the bug ID for duplicate IPSEC tunnels showing on Palo Alto/Panorama in 10.1.5 version ?

Re: duplicate ipsec tunnels

RajivYadav — Mon, 28 Nov 2022 10:40:21 GMT

This has been fixed in Pan-os 10.1.8.

Re: duplicate ipsec tunnels

dgarnsey — Fri, 13 Jan 2023 06:39:24 GMT

I have firewalls running 10.2.0 and Panorama running 10.2.3. I am still seeing this problem - no duplicate tunnels on Panorama but every tunnel duplicated on the firewall.

Re: duplicate ipsec tunnels

Raido_Rattameister — Fri, 13 Jan 2023 13:18:10 GMT

Preferred version for 10.2.x branch is 10.2.3-h2

It does not have duplicate tunnels there.

10.2.0 is old and has CVEs fixed in later releases.

Re: duplicate ipsec tunnels

dgarnsey — Sun, 15 Jan 2023 23:23:42 GMT

Thanks Raido, 10.2.3-h2 fixed it.

Re: duplicate ipsec tunnels

rsaloskar — Thu, 19 Jan 2023 03:45:52 GMT

I went from 9.1.13 to 10.1.8. i did see this weird behavior when my firewalls were on 10.0.11 along the upgrade path. No actions taken. just upgrade.

Re: duplicate ipsec tunnels

Ivyliao1 — Tue, 07 Feb 2023 18:52:21 GMT

I have the exact same issue.

2 VPN tunnels are pushed from panorama. But the managed firewalls show 4 tunnels -- 2 from panorama and 2 on local firewalls.

However, no VPN configuration can be on the firewalls. And these 4 tunnels are replicated.

Re: duplicate ipsec tunnels

Raido_Rattameister — Tue, 07 Feb 2023 19:18:34 GMT

Why do you keep firewall operating system on old version and don't upgrade to preferred version?

Re: duplicate ipsec tunnels

Ivyliao1 — Tue, 07 Feb 2023 19:31:10 GMT

Raido,

We can't use PAN-OS v10.2 yet.

Which V10.1 version has the fix as well?