topic Re: IPSec IKEv2 multiple events per second in General Topics

IPSec IKEv2 multiple events per second

MostafaSafari — Tue, 07 May 2024 13:46:13 GMT

Hello everyone,

I see many events per second for a site-to-site IPSec tunnel and am unsure if it's normal. The below events have a severity level of informational but go over and over in a second.

My question is, is it normal? if not, where should I look to fix it? What can be wrong?

ikev2-nego-child-start
ikev2-nego-ike-start
ipsec-key-delete
ikev2-recv-p2-delete
ipsec-key-delete
ikev2-send-p2-delete
ikev2-nego-ike-succ
ikev2-nego-child-succ
ipsec-key-install
ikev2-nego-child-start
ikev2-nego-ike-start
ikev2-recv-p2-delete
ipsec-key-delete
ikev2-send-p2-delete
ikev2-recv-p1-delete
ikev2-nego-child-succ
ipsec-key-install
ikev2-nego-child-start

Re: IPSec IKEv2 multiple events per second

Raido_Rattameister — Tue, 07 May 2024 14:44:16 GMT

It is not normal.

It usually happens if proxy-id's don't match with peer side

Re: IPSec IKEv2 multiple events per second

MostafaSafari — Tue, 07 May 2024 14:50:20 GMT

We didn't set up proxy IDs but I will add and check.

Thank you

Re: IPSec IKEv2 multiple events per second

Raido_Rattameister — Tue, 07 May 2024 14:56:13 GMT

If you did not set up proxy id's then Palo sends 0.0.0.0/0 to other side.

You can dig deeper by following KB https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcKCAS

Instead of less command at the end you can run "tail follow yes mp-log ikemgr.log" to get updates in real time.