topic Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth) in General Topics

IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

cmet — Wed, 09 Nov 2011 12:25:06 GMT

I can complete phase 1 but then the tunnel terminates without a message witch would help me to find the problem.

2011-11-09 13:20:51 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION STARTED AS RESPONDER, AGGRESSIVE MODE <====
====> Initiated SA: 77.73.243.180[500]-178.83.248.50[55010] cookie:f170f45f0119ad13:b32d0b9e1e6e49e7 <====
2011-11-09 13:20:51 [INFO]: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt
2011-11-09 13:20:51 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-00
2011-11-09 13:20:51 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-01
2011-11-09 13:20:51 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02

2011-11-09 13:20:51 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-03
2011-11-09 13:20:51 [INFO]: received Vendor ID: RFC 3947
2011-11-09 13:20:51 [INFO]: received Vendor ID: FRAGMENTATION
2011-11-09 13:20:51 [INFO]: received Vendor ID: DPD
2011-11-09 13:20:51 [INFO]: received Vendor ID: CISCO-UNITY
2011-11-09 13:20:51 [INFO]: Selected NAT-T version: RFC 3947
2011-11-09 13:20:51 [INFO]: Adding remote and local NAT-D payloads.
2011-11-09 13:20:51 [INFO]: Hashing 178.83.248.50[55010] with algo #2
2011-11-09 13:20:51 [INFO]: Hashing 77.73.243.180[500] with algo #2
2011-11-09 13:20:51 [PROTO_ERR]: ignore information because ISAKMP-SA has not been established yet.
2011-11-09 13:20:51 [INFO]: Hashing 77.73.243.180[4500] with algo #2
2011-11-09 13:20:51 [INFO]: NAT-D payload #0 doesn't match
2011-11-09 13:20:51 [INFO]: Hashing 178.83.248.50[55060] with algo #2
2011-11-09 13:20:51 [INFO]: NAT-D payload #1 doesn't match
2011-11-09 13:20:51 [INFO]: NAT detected: ME PEER
2011-11-09 13:20:51 [INFO]: Sending Xauth request
2011-11-09 13:20:51 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION SUCCEEDED AS RESPONDER, AGGRESSIVE MODE <====
====> Established SA: 77.73.243.180[4500]-178.83.248.50[55060] cookie:f170f45f0119ad13:b32d0b9e1e6e49e7 lifetime 3600 Sec <====
2011-11-09 13:21:51 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <====
====> Expired SA: 77.73.243.180[4500]-178.83.248.50[55060] cookie:f170f45f0119ad13:b32d0b9e1e6e49e7i <====
2011-11-09 13:21:51 [INTERNAL_ERR]: ASSERT FAILED: (iph1->status == PHASE1ST_ESTABLISHED)
2011-11-09 13:21:51 [INFO]: ====> PHASE-1 SA DELETED <====
====> Deleted SA: 77.73.243.180[4500]-178.83.248.50[55060] cookie:f170f45f0119ad13:b32d0b9e1e6e49e7i <====

The clients terminates after the Established SA with vpn error. What could be the problem?

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

djrodb — Thu, 10 Nov 2011 09:45:05 GMT

Have you got a tick in the "skip auth on IKE rekey" option? if its selected try unselecting it and retry your connection. This is under the GP gateway screen general tab and belpw the group password fields.

Rod

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

cmet — Fri, 11 Nov 2011 08:29:40 GMT

Dosn't make a difference...same problem.

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

cmet — Fri, 11 Nov 2011 10:05:26 GMT

What means this error?

[INTERNAL_ERR]: ASSERT FAILED: (iph1->status == PHASE1ST_ESTABLISHED)

On my pa500 everything is working on the pa2050 nothing works out of the box. The Portal dosn't work on the external interface...had to use loopback plus nat rules...and now xauth dosn't work too...getting pretty frustated.

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

rapoint_person — Fri, 11 Nov 2011 14:22:10 GMT

I never got Shrew working, (didn't put that much effort in to it either). VPNC works like a charm though. I actually prefer VPNC as it is integrated with NetworkManager (I'm on a Ubuntu box).

Simply put in the following in the client:

Gateway: globlaprotect.company.com

Username (Most cases your LDAP/AD user account authenticating with Kerberos/LDAP)

Group name: sharedusername (xauth shared user in Palo)

Group Passwd:

Encryption Standard

NATT: Enabled

xAuth enabled, IPsec enabled, Skip Ike rekey = Palo Alto side of things.

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

bpappas — Fri, 11 Nov 2011 21:21:18 GMT

@mccue:

question: are you using NAT-T? If so can you turn it off and try again?

Thanks,

Benjamin

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

cmet — Mon, 14 Nov 2011 07:53:12 GMT

Yes I use Nat-t and the funny thing again is, it works with my other customer. He is using a PA500..everything works on that pa500 where nothing seems to work on the pa2050.

I realy don't get it..the only difference in the config is that the customer on the pa500 has no inside nat on the external ip, where the customer on the pa2050 has inside nat on the ip..but not on port 80.443. 500, 4500. So it should not conflict...but then still i can't setup the gateway on the external interface directly (well i can but it is not reachable). And over a loopback interface it dosn't work somehow....

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

mrajdev — Wed, 16 Nov 2011 00:54:16 GMT

Mcue,

This issue is targeted to be fixed in 4.1.1.

Thanks

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

gsteiner — Wed, 23 Nov 2011 09:31:03 GMT

Is this a problem on the pa2050?

Globalprotect and everything works but from a ipad the ike phase1 goes trough but then no authentication starts.

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

bpappas — Thu, 24 Nov 2011 00:40:52 GMT

@gsteiner:

my team and I did some testing in our lab last night running 4.1.0 PAN-OS on a 2050. We had no trouble connecting an iPad2 running iOS version 4.3.5 (8L1) to our 2050 Global Protect Gateway, authenticating and accessing resources behind the 2050. iPad was using WiFi (not 3G mobile/cellular).

-Benjamin

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

gsteiner — Thu, 24 Nov 2011 11:32:00 GMT

any idea where the problem could be? Ike Phase1 completes but then phase2 dosn't start, it just stays there till timeout.

Globalprotect and even Shrew Soft VPN is now working.

is there a log which i could monitor? i used

tail follow yes mp-log ikemgr.log

and

tail follow yes mp-log authd.log

but in the authd.log nothing comes up.

ipad version 5.0.1 (9a405)

btw. I use PSK

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

gsteiner — Thu, 24 Nov 2011 12:02:22 GMT

could this be a problem?

Nov 24 12:59:27 pan_authd_get_lock_cfg(pan_authd_ops.c:449): Profile Auth-Seq not found in sequence or profile db.
Nov 24 12:59:27 pan_authd_get_lock_cfg(pan_authd_ops.c:441): Auth Seq __dummy_%_admin_%_profile__ found. Max attempts=0, lockseconds=0.
Nov 24 12:59:27 pan_authd_get_lock_cfg(pan_authd_ops.c:449): Profile AUTH-SEQUENCE not found in sequence or profile db.
Nov 24 12:59:27 pan_authd_get_lock_cfg(pan_authd_ops.c:449): Profile AUTH-SEQUENCE not found in sequence or profile db.
Nov 24 13:00:25 cfgagent_opcmd_callback(pan_cfgagent.c:344): authd: cfg agent received op command from server
Nov 24 13:00:25 cfgagent_doop_callback(pan_cfgagent.c:378): received sigal to execute <operations xml="yes" type="union" handler="show_lockedusers_handler"><show type="union"><authentication type="union"><locked-users type="sequence"><is-seq type="enum">yes</is-seq></locked-users></authentication></show></operations>
Nov 24 13:00:52 cfgagent_opcmd_callback(pan_cfgagent.c:344): authd: cfg agent received op command from server
Nov 24 13:00:52 cfgagent_doop_callback(pan_cfgagent.c:378): received sigal to execute <request cmd="op" complete="/operations/set/management-server/unlock/admin" cookie="4985870072261854" handler="admin_unlock_complete_handler"/>
Nov 24 13:00:52 pan_authd_get_lock_cfg(pan_authd_ops.c:449): Profile Auth-Seq not found in sequence or profile db.
Nov 24 13:00:52 pan_authd_get_lock_cfg(pan_authd_ops.c:441): Auth Seq __dummy_%_admin_%_profile__ found. Max attempts=0, lockseconds=0.
Nov 24 13:00:52 pan_authd_get_lock_cfg(pan_authd_ops.c:449): Profile AUTH-SEQUENCE not found in sequence or profile db.
Nov 24 13:00:52 pan_authd_get_lock_cfg(pan_authd_ops.c:449): Profile AUTH-SEQUENCE not found in sequence or profile db.

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

gsteiner — Fri, 25 Nov 2011 07:21:19 GMT

Could it be that the Problem is Nat-t ? When I use Shrewsoft vpn client and turn off nat-t it is working, when i turn it on it dosn't work.

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

mrajdev — Mon, 28 Nov 2011 20:09:06 GMT

Hi,

We have one issue related to NAT-T which will be fixed in 4.1.1. For your issue I would suggest you to open up a support case so that we can review the log/debug information to determine if the issue you are seeing is the one which is going to be fixed or if this issue is a different one.

Thanks

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

gsteiner — Mon, 19 Dec 2011 07:36:05 GMT

Still the same issue, I can connect with the same IPAD to a PA500 running 4.1.0 but not to the PA2050 with 4.1.1

Shrew Soft VPN work with Nat-T or not on the PA500, but it dosn't work with Nat-T Port 4500 on the PA2050. It works only without Nat-t on the PA2050

Please this issue is bugging now for to long, i opened two ticket and they told me this is fixed in 4.1.1 and now the problem is still there..Am I realy the only one with this issue?

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

gsteiner — Mon, 19 Dec 2011 08:17:25 GMT

This is the IKE Log from the working PA500 with Shrew Soft

====> Initiated SA: 193.192.245.3[500]-178.83.248.50[500] cookie:9a06606b703bfe15:1127f0f10e6ed595 <====
2011-12-19 09:07:36 [INFO]: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt
2011-12-19 09:07:36 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-00
2011-12-19 09:07:36 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-01
2011-12-19 09:07:36 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02

2011-12-19 09:07:36 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-03
2011-12-19 09:07:36 [INFO]: received Vendor ID: RFC 3947
2011-12-19 09:07:36 [INFO]: received Vendor ID: FRAGMENTATION
2011-12-19 09:07:36 [INFO]: received Vendor ID: DPD
2011-12-19 09:07:36 [INFO]: received Vendor ID: CISCO-UNITY
2011-12-19 09:07:36 [INFO]: Selected NAT-T version: RFC 3947
2011-12-19 09:07:36 [INFO]: Adding remote and local NAT-D payloads.
2011-12-19 09:07:36 [INFO]: Hashing 178.83.248.50[500] with algo #2
2011-12-19 09:07:36 [INFO]: Hashing 193.192.245.3[500] with algo #2
2011-12-19 09:07:36 [INFO]: Hashing 193.192.245.3[4500] with algo #2
2011-12-19 09:07:36 [INFO]: NAT-D payload #0 doesn't match
2011-12-19 09:07:36 [INFO]: Hashing 178.83.248.50[4500] with algo #2
2011-12-19 09:07:36 [INFO]: NAT-D payload #1 doesn't match
2011-12-19 09:07:36 [INFO]: NAT detected: ME PEER
2011-12-19 09:07:36 [INFO]: Sending Xauth request

====> Established SA: 193.192.245.3[4500]-178.83.248.50[4500] cookie:9a06606b703bfe15:1127f0f10e6ed595 lifetime 3600 Sec <====
2011-12-19 09:07:36 [PROTO_NOTIFY]: notification message 24578:INITIAL-CONTACT, doi=1 proto_id=1 spi=9a06606b703bfe15 1127f0f10e6ed595 (size=16).
2011-12-19 09:07:37 [INFO]: login succeeded for user "stg"
2011-12-19 09:07:37 [INFO]: GP gateway SSLVPN domain user stg from 178.83.248.50 login rtn 1 lifetime 3600
2011-12-19 09:07:37 [PROTO_WARN]: Ignored attribute INTERNAL_ADDRESS_EXPIRY
2011-12-19 09:07:44 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS RESPONDER, (QUICK MODE) <====
====> Initiated SA: 193.192.245.3[4500]-178.83.248.50[4500] message id:0xDF847760 <====
2011-12-19 09:07:44 [INFO]: use own lifetime: my:3300 peer:3600
2011-12-19 09:07:44 [INFO]: Adjusting peer's encmode UDP-Tunnel(3)->Tunnel(1)
2011-12-19 09:07:44 [INFO]: GP gateway SSLVPN user stg lifetime extend 3300 sec (phase 2) rtn 0
2011-12-19 09:07:44 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION SUCCEEDED AS RESPONDER, (QUICK MODE) <====
====> Established SA: 193.192.245.3[4500]-178.83.248.50[4500] message id:0xDF847760, SPI:0xEF5D98E6/0xD41568B9 <====
2011-12-19 09:07:44 [INFO]: pfkey update: ESP/Tunnel 178.83.248.50[4500]->193.192.245.3[4500] spi=4015888614(0xef5d98e6); client ip 192.168.91.2
2011-12-19 09:07:44 [INFO]: SADB_UPDATE ul_proto=255 src=178.83.248.50[4500] dst=193.192.245.3[4500] satype=ESP samode=tunl spi=0xEF5D98E6 authtype=SHA1 enctype=AES256 lifetime soft time=3300 bytes=0 hard time=3300 bytes=0
2011-12-19 09:07:44 [INFO]: SADB_ADD ul_proto=255 src=193.192.245.3[4500] dst=178.83.248.50[4500] satype=ESP samode=tunl spi=0xD41568B9 authtype=SHA1 enctype=AES256 lifetime soft time=3300 bytes=0 hard time=3300 bytes=0
2011-12-19 09:07:44 [INFO]: IPsec-SA established: ESP/Tunnel 178.83.248.50[4500]->193.192.245.3[4500] spi=4015888614(0xef5d98e6)
2011-12-19 09:07:44 [PROTO_NOTIFY]: ====> IPSEC KEY INSTALLATION SUCCEEDED <====
====> Installed SA: 193.192.245.3[4500]-178.83.248.50[4500] SPI:0xEF5D98E6/0xD41568B9 lifetime 3300 Sec lifesize unlimited <====
2011-12-19 09:07:44 [INFO]: keymirror add start ++++++++++++++++
2011-12-19 09:07:44 [INFO]: keymirror add for gw c0a85b02, tn 11, selfSPI EF5D98E6, retcode 0.
2011-12-19 09:07:44 [INFO]: KA list add: 193.192.245.3[4500]->178.83.248.50[4500]

And this is the IKE Log from the NOT working PA2050 with Shrew Soft

====> Initiated SA: 77.73.243.83[500]-178.83.248.50[500] cookie:0a278884227829f8:e228b72ddb2ccc2f <====
2011-12-19 09:05:37 [INFO]: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt
2011-12-19 09:05:37 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-00
2011-12-19 09:05:37 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-01
2011-12-19 09:05:37 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02

2011-12-19 09:05:37 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-03
2011-12-19 09:05:37 [INFO]: received Vendor ID: RFC 3947
2011-12-19 09:05:37 [INFO]: received Vendor ID: FRAGMENTATION
2011-12-19 09:05:37 [INFO]: received Vendor ID: DPD
2011-12-19 09:05:37 [INFO]: received Vendor ID: CISCO-UNITY
2011-12-19 09:05:37 [INFO]: Selected NAT-T version: RFC 3947
2011-12-19 09:05:37 [INFO]: Adding remote and local NAT-D payloads.
2011-12-19 09:05:37 [INFO]: Hashing 178.83.248.50[500] with algo #2
2011-12-19 09:05:37 [INFO]: Hashing 77.73.243.83[500] with algo #2
2011-12-19 09:06:30 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION FAILED AS RESPONDER, AGGRESSIVE MODE <====

This is the IKE Log from the PA500 with IPAD 5.0

2011-12-19 09:14:29 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION STARTED AS RESPONDER, AGGRESSIVE MODE <====
====> Initiated SA: 193.192.245.3[500]-178.83.248.50[500] cookie:3a51fa6944affee1:303b0958686db0bb <====
2011-12-19 09:14:29 [INFO]: received Vendor ID: RFC 3947
2011-12-19 09:14:29 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-08
2011-12-19 09:14:29 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-07
2011-12-19 09:14:29 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-06
2011-12-19 09:14:29 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-05
2011-12-19 09:14:29 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-04
2011-12-19 09:14:29 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-03
2011-12-19 09:14:29 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
2011-12-19 09:14:29 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02

2011-12-19 09:14:29 [INFO]: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt
2011-12-19 09:14:29 [INFO]: received Vendor ID: CISCO-UNITY
2011-12-19 09:14:29 [INFO]: received Vendor ID: DPD
2011-12-19 09:14:29 [INFO]: Selected NAT-T version: RFC 3947
2011-12-19 09:14:29 [INFO]: Adding remote and local NAT-D payloads.
2011-12-19 09:14:29 [INFO]: Hashing 178.83.248.50[500] with algo #2
2011-12-19 09:14:29 [INFO]: Hashing 193.192.245.3[500] with algo #2
2011-12-19 09:14:31 [INFO]: Hashing 193.192.245.3[4500] with algo #2
2011-12-19 09:14:31 [INFO]: NAT-D payload #0 verified
2011-12-19 09:14:31 [INFO]: Hashing 178.83.248.50[55042] with algo #2
2011-12-19 09:14:31 [INFO]: NAT-D payload #1 doesn't match
2011-12-19 09:14:31 [INFO]: NAT detected: PEER
2011-12-19 09:14:31 [INFO]: reveived INITIAL-CONTACT notification.
2011-12-19 09:14:31 [INFO]: Sending Xauth request
2011-12-19 09:14:31 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION SUCCEEDED AS RESPONDER, AGGRESSIVE MODE <====
====> Established SA: 193.192.245.3[4500]-178.83.248.50[55042] cookie:3a51fa6944affee1:303b0958686db0bb lifetime 3600 Sec <====
2011-12-19 09:14:40 [INFO]: login succeeded for user "stg"
2011-12-19 09:14:40 [INFO]: GP gateway SSLVPN domain user stg from 178.83.248.50 login rtn 1 lifetime 3600
2011-12-19 09:14:40 [PROTO_WARN]: Ignored attribute INTERNAL_ADDRESS_EXPIRY
2011-12-19 09:14:40 [PROTO_WARN]: Ignored attribute UNITY_BROWSER_PROXY
2011-12-19 09:14:42 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS RESPONDER, (QUICK MODE) <====
====> Initiated SA: 193.192.245.3[4500]-178.83.248.50[55042] message id:0x2FDD1E6B <====
2011-12-19 09:14:42 [INFO]: use own lifetime: my:3300 peer:3600
2011-12-19 09:14:42 [INFO]: Adjusting peer's encmode UDP-Tunnel(3)->Tunnel(1)
2011-12-19 09:14:42 [INFO]: GP gateway SSLVPN user stg lifetime extend 3300 sec (phase 2) rtn 0
2011-12-19 09:14:42 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION SUCCEEDED AS RESPONDER, (QUICK MODE) <====
====> Established SA: 193.192.245.3[4500]-178.83.248.50[55042] message id:0x2FDD1E6B, SPI:0xE2127A38/0x01EB041A <====
2011-12-19 09:14:42 [INFO]: pfkey update: ESP/Tunnel 178.83.248.50[55042]->193.192.245.3[4500] spi=3792861752(0xe2127a38); client ip 192.168.91.3
2011-12-19 09:14:42 [INFO]: SADB_UPDATE ul_proto=255 src=178.83.248.50[55042] dst=193.192.245.3[4500] satype=ESP samode=tunl spi=0xE2127A38 authtype=SHA1 enctype=AES256 lifetime soft time=3300 bytes=0 hard time=3300 bytes=0
2011-12-19 09:14:42 [INFO]: SADB_ADD ul_proto=255 src=193.192.245.3[4500] dst=178.83.248.50[55042] satype=ESP samode=tunl spi=0x01EB041A authtype=SHA1 enctype=AES256 lifetime soft time=3300 bytes=0 hard time=3300 bytes=0
2011-12-19 09:14:42 [INFO]: IPsec-SA established: ESP/Tunnel 178.83.248.50[55042]->193.192.245.3[4500] spi=3792861752(0xe2127a38)
2011-12-19 09:14:42 [PROTO_NOTIFY]: ====> IPSEC KEY INSTALLATION SUCCEEDED <====
====> Installed SA: 193.192.245.3[4500]-178.83.248.50[55042] SPI:0xE2127A38/0x01EB041A lifetime 3300 Sec lifesize unlimited <====
2011-12-19 09:14:42 [INFO]: keymirror add start ++++++++++++++++
2011-12-19 09:14:42 [INFO]: keymirror add for gw c0a85b03, tn 11, selfSPI E2127A38, retcode 0.
2011-12-19 09:14:42 [INFO]: KA list add: 193.192.245.3[4500]->178.83.248.50[55042]

And this is the IKE Log from the NOT working PA2050 with IPAD 5.0

2011-12-19 09:11:31 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION STARTED AS RESPONDER, AGGRESSIVE MODE <====
====> Initiated SA: 77.73.243.83[500]-178.83.248.50[55040] cookie:33a456a8dd879424:c513281a28ad709e <====
2011-12-19 09:11:31 [INFO]: received Vendor ID: RFC 3947
2011-12-19 09:11:31 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-08
2011-12-19 09:11:31 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-07
2011-12-19 09:11:31 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-06
2011-12-19 09:11:31 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-05
2011-12-19 09:11:31 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-04
2011-12-19 09:11:31 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-03
2011-12-19 09:11:31 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
2011-12-19 09:11:31 [INFO]: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02

2011-12-19 09:11:31 [INFO]: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt
2011-12-19 09:11:31 [INFO]: received Vendor ID: CISCO-UNITY
2011-12-19 09:11:31 [INFO]: received Vendor ID: DPD
2011-12-19 09:11:31 [INFO]: Selected NAT-T version: RFC 3947
2011-12-19 09:11:31 [INFO]: Adding remote and local NAT-D payloads.
2011-12-19 09:11:31 [INFO]: Hashing 178.83.248.50[55040] with algo #2
2011-12-19 09:11:31 [INFO]: Hashing 77.73.243.83[500] with algo #2
2011-12-19 09:11:33 [INFO]: Hashing 77.73.243.83[4500] with algo #2
2011-12-19 09:11:33 [INFO]: NAT-D payload #0 verified
2011-12-19 09:11:33 [INFO]: Hashing 178.83.248.50[55042] with algo #2
2011-12-19 09:11:33 [INFO]: NAT-D payload #1 doesn't match
2011-12-19 09:11:33 [INFO]: NAT detected: PEER
2011-12-19 09:11:33 [INFO]: reveived INITIAL-CONTACT notification.
2011-12-19 09:11:33 [INFO]: Sending Xauth request
2011-12-19 09:11:33 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION SUCCEEDED AS RESPONDER, AGGRESSIVE MODE <====
====> Established SA: 77.73.243.83[4500]-178.83.248.50[55042] cookie:33a456a8dd879424:c513281a28ad709e lifetime 3600 Sec <====
2011-12-19 09:12:33 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <====
====> Expired SA: 77.73.243.83[4500]-178.83.248.50[55042] cookie:33a456a8dd879424:c513281a28ad709ei <====
2011-12-19 09:12:33 [INTERNAL_ERR]: ASSERT FAILED: (iph1->status == PHASE1ST_ESTABLISHED)
2011-12-19 09:12:33 [INFO]: ====> PHASE-1 SA DELETED <====
====> Deleted SA: 77.73.243.83[4500]-178.83.248.50[55042] cookie:33a456a8dd879424:c513281a28ad709ei <====

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

gsteiner — Mon, 23 Jan 2012 09:00:37 GMT

unbelievable!!!

The New PANIOS 4.1.2 Fixed my Problems finaly!

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

tomkas — Thu, 26 Jan 2012 10:42:50 GMT

Hello gsteiner.

Which settings in PaloAlto firewall and ShrewSoft VPN clients configurations are allowing to connect them? When I tried, I didn't managed even to get any trace of activity in ikemgr.log when trying to connect from ShrewSoft VPN Client (linux and Windows) to my PA4020. I enabled Enable X-Auth Support, set up gateway with Group Name and Group Password and tried different settings in ShrewSoft VPN client, no success at all.

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

gsteiner — Thu, 26 Jan 2012 16:43:53 GMT

In ShrewSoft

General HostName and IP. Port 500

Client Settings default.

Name Resolution default.

Authentication

Mutual PSK + XAuth

Local Identification Type

Key Identifier

Key ID String

steria

Remote Identity

any

Credentials

Pre Shared Key

"the one you did set in the globalprotect" (GroupPassword)

Phase 1 and two default.

Hope that helped

Don't forget the firewall rules! Application is ciscovpn, ike, ipsec, ssl and web-browsing.

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

jmrodriguez — Tue, 17 Jul 2012 07:37:28 GMT

Hi gsteiner.

Thanks for your configuration.

Maybe you could help me. I've got a problem related to Access Route configuration in GlobalProtect Gateway in my PaloAlto (2050 and 4.1.6 version).

This problem happens to me with vpnc, Shrew and Cisco VPN clients.

I can connect to my VPN gateway correctly, but:

- If I've got only one access route configured in the PaloAlto (10.0.0.0/8), I obtain the correct routes and everything works fine:

root@vangogh:/usr/local/lib# netstat -nr

Kernel IP routing table

Destination Gateway Genmask Flags MSS Window irtt Iface

X.X.X.X 192.168.1.1 255.255.255.255 UGH 0 0 0 wlan0

192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0

10.0.0.0 172.16.20.11 255.0.0.0 UG 0 0 0 tap0

0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 wlan0

- If I've got more than one access route configured in the PaloAlto (10.0.0.0/8 and 172.16.0.0/12), I don't obtain the correct routes:

root@vangogh:/usr/local/lib# netstat -nr

Kernel IP routing table

Destination Gateway Genmask Flags MSS Window irtt Iface

X.X.X.X 192.168.1.1 255.255.255.255 UGH 0 0 0 wlan0

192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0

0.0.0.0 172.16.20.11 0.0.0.0 UG 0 0 0 tap0

0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 wlan0

Anyone has seen this error before? Could you help me, please?

Thank you very much.