VPN Traffic not match configured policy hitting default trust to Untrust

boba-ny89 — Mon, 04 Dec 2023 18:22:05 GMT

Need some assistance with A S2S VPN - We have configured a Similar tunnel from another site to destination 3rd party peer and it's working. The 2nd site is configured the same as the working one. What I cant figure out is the tunnel is up, both tunnel interfaces are up. The Virtual router has static routes to desti primary with metric of 10 and Sec metric of 20. The tunnel shows encaps and decaps, yet I cant ping form either the local Palo side or the other side back. I check via both the GUI Device/Troubleshooting the policy match and routing to desti all are correct. When I check traffic monitor traffic is going from trust to Untrust not Trust to the VPN_Site zone. I ran the following test also, from the cli the test security policy is correct , just cant figure out why traffci to desti 10.252.53.x is not matching. Going to run a packet cap to see if it yields any info as to why

Here's my output: The rule ID is correct and the desti zone is correct.

"VPN_DC_to_<correct Rule>; index: 3" {
from trust;
source 10.47.4.0/24;
source-region none;
to vpn_<correct zone Name>;
destination 10.252.53.0/24;
destination-region none;
user any;
category any;
application/service 0:any/any/any/any;
action allow;
icmp-unreachable: no
terminal yes;

Also, encaps/decaps are incrementing
xxxx-220-1(active)> show vpn flow name DC_to_<correct IPSEC Policy>-Primary | match bytes
encap bytes: 9860040
decap bytes: 9856584
xxxx-220-1(active)> show vpn flow name DC_to_<coorect IPSEC Policy>-Primary | match bytes
encap bytes: 9860160
decap bytes: 9856704

Here's the monitor showing it hitting the wrong rule trust to untrust

Re: VPN Traffic not match configured policy hitting default trust to Untrust

boba-ny89 — Sat, 09 Dec 2023 10:51:34 GMT

I have resolved this issue.

I found there was a PBF rule that was causing the traffic to route out the ISP next hop as opposed to the tunnel interfaces I set up. I added two PBF rules to send the traffic to the primary tunnel interface and a second to the Secondary tunnel interface. Used monitoring of next hop Sonicwall Tunnel interface IP's and all is ok. Both tunnels work fine - tested simulating a failure of primary from remote site of PA.

topic Re: VPN Traffic not match configured policy hitting default trust to Untrust in General Topics

VPN Traffic not match configured policy hitting default trust to Untrust

Re: VPN Traffic not match configured policy hitting default trust to Untrust