topic Re: IPSEC VPN Tunnel Problem in General Topics

IPSEC VPN Tunnel Problem

almay — Tue, 18 Sep 2012 16:26:31 GMT

PAN PA2020 PAN OS 4.16

I have a point to point vpn setup from our company to another company that is hosting our financial application.

We have 10 different proxy IDs setup to limit subnet's that can access the vpn for example:

Almost everyday, all proxy ids can access the vpn tunnel with the exception of proxy id 2 or proxy id 3.

Any thoughts?

Thank you in advance...

Re: IPSEC VPN Tunnel Problem

GaryFowler — Tue, 18 Sep 2012 17:25:15 GMT

What is the device on the other side of the VPN?

Do you see any errors in the system log? Monitor / Logs / System?

If the remote side is a CheckPoint, then it may be joining 192.168.2.0/24 and 192.168.3.0/24 into a larger subnet, 192.168.2.0/23.

--- UPDATE:

I tested this in my lab. The PAN with report the proxy IDs using during phase 2, even when the negotiation fails. This makes it much easier to determine if the other side has fat fingered a encryption domain / crypto-map ACL

Such a beautiful device.

Re: IPSEC VPN Tunnel Problem

UhMayYeah — Tue, 18 Sep 2012 19:03:55 GMT

a> Check if the routes have been configured pointing to the tunnel interface.

b>Security rules allowing traffic between the inside and tunnel zone.

Also check if the peer device has a rule allowing this traffic.

Check traffic logs filtering the source and dest, include the columns bytes sent and received to see if PA is dropping the traffic or if we are not getting responses.

-Ameya