topic Re: Tunnel flow in General Topics https://live.paloaltonetworks.com/t5/general-topics/tunnel-flow/m-p/25792#M18809 <HTML><HEAD></HEAD><BODY><P>Hello Infotech,</P><P></P><P>The SPI (security parameter Index) value will be same for a specific Proxy-ID. Hence there will be a pair of keys for encryption and decryption.&nbsp; You will be able to see <SPAN class="GINGER_SOFTWARE_mark">encap/decap</SPAN> or incoming byte/outgoing bytes from tunnel point of view.</P><P></P><P>&gt; <SPAN class="GINGER_SOFTWARE_mark">show</SPAN> <SPAN class="GINGER_SOFTWARE_mark">vpn</SPAN> flow tunnel-id XX<SPAN class="GINGER_SOFTWARE_mark"> ---</SPAN></P><P></P><P>Thanks</P></BODY></HTML> Fri, 30 May 2014 20:25:49 GMT HULK 2014-05-30T20:25:49Z Tunnel flow https://live.paloaltonetworks.com/t5/general-topics/tunnel-flow/m-p/25791#M18808 <HTML><HEAD></HEAD><BODY><P>How do you check to see if there is bidrectional flow on a vpn tunnel?</P></BODY></HTML> Fri, 30 May 2014 19:25:33 GMT https://live.paloaltonetworks.com/t5/general-topics/tunnel-flow/m-p/25791#M18808 infotech 2014-05-30T19:25:33Z Re: Tunnel flow https://live.paloaltonetworks.com/t5/general-topics/tunnel-flow/m-p/25792#M18809 <HTML><HEAD></HEAD><BODY><P>Hello Infotech,</P><P></P><P>The SPI (security parameter Index) value will be same for a specific Proxy-ID. Hence there will be a pair of keys for encryption and decryption.&nbsp; You will be able to see <SPAN class="GINGER_SOFTWARE_mark">encap/decap</SPAN> or incoming byte/outgoing bytes from tunnel point of view.</P><P></P><P>&gt; <SPAN class="GINGER_SOFTWARE_mark">show</SPAN> <SPAN class="GINGER_SOFTWARE_mark">vpn</SPAN> flow tunnel-id XX<SPAN class="GINGER_SOFTWARE_mark"> ---</SPAN></P><P></P><P>Thanks</P></BODY></HTML> Fri, 30 May 2014 20:25:49 GMT https://live.paloaltonetworks.com/t5/general-topics/tunnel-flow/m-p/25792#M18809 HULK 2014-05-30T20:25:49Z Re: Tunnel flow https://live.paloaltonetworks.com/t5/general-topics/tunnel-flow/m-p/25793#M18810 <HTML><HEAD></HEAD><BODY><P>So this is showing flow in and out tunnel7 - so why isn't there communication between my two site connected by this tunnel working?</P><P>tunnel&nbsp; DR_IPSec_Tunnel7</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; id:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 130</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IPSec</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; gateway id:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 7</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; local ip:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 66.94.196.107</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; peer ip:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 66.94.208.114</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; inner interface:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tunnel.7</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; outer interface:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ethernet1/3</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; state:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; active</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 4635</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tunnel mtu:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1428</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; lifetime remain:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1201 sec</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; latest rekey:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2399 seconds ago</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; monitor:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; off</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; monitor packets seen:&nbsp;&nbsp; 0</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; monitor packets reply:&nbsp; 0</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; en/decap context:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 170</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; local spi:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 9AC6CEDC</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; remote spi:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DF67E405</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; key type:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; auto key</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; protocol:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ESP</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; auth algorithm:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SHA1</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; enc&nbsp; algorithm:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; AES256</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proxy-id local ip:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proxy-id remote ip:&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proxy-id protocol:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proxy-id local port:&nbsp;&nbsp;&nbsp; 0</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proxy-id remote port:&nbsp;&nbsp; 0</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; anti replay check:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; yes</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; copy tos:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; no</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; authentication errors:&nbsp; 0</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; decryption errors:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; inner packet warnings:&nbsp; 0</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; replay packets:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; packets received</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; when lifetime expired:0</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; when lifesize expired:0</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sending sequence:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 734</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; receive sequence:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 600</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; encap packets:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 734</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; decap packets:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 600</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; encap bytes:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 86352</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; decap bytes:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 72000</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; key acquire requests:&nbsp;&nbsp; 0</P></BODY></HTML> Fri, 30 May 2014 20:33:17 GMT https://live.paloaltonetworks.com/t5/general-topics/tunnel-flow/m-p/25793#M18810 infotech 2014-05-30T20:33:17Z Re: Tunnel flow https://live.paloaltonetworks.com/t5/general-topics/tunnel-flow/m-p/25794#M18811 <HTML><HEAD></HEAD><BODY><P>Hello Infotech,</P><P></P><P>As <SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark">i</SPAN></SPAN> mentioned before, there will be only a pair of keys for encryption and <SPAN class="GINGER_SOFTWARE_mark">decryption</SPAN>.</P><P></P><P style="font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; color: #3b3b3b;"><STRONG><SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark">local</SPAN></SPAN></STRONG><STRONG> <SPAN class="GINGER_SOFTWARE_mark"></SPAN><SPAN class="GINGER_SOFTWARE_mark"></SPAN><SPAN class="GINGER_SOFTWARE_mark"></SPAN><SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark">spi</SPAN></SPAN></SPAN>:</STRONG>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 9AC6CEDC&nbsp; &gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt; It will be used for encrypting traffic going into the tunnel.</P><P style="font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; color: #3b3b3b;"><STRONG><SPAN class="GINGER_SOFTWARE_mark">remote</SPAN></STRONG><STRONG> <SPAN class="GINGER_SOFTWARE_mark"></SPAN><SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark">spi</SPAN></SPAN><SPAN class="GINGER_SOFTWARE_mark">:</SPAN> </STRONG>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DF67E405&nbsp;&nbsp; &gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt; It will be used for decrypting traffic coming through the tunnel from other end FW</P><P style="font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; color: #3b3b3b;"></P><P style="font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; color: #3b3b3b;">So, there is no specific way to track bidirectional flow through the VPN (<SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark">0.0.0.0</SPAN></SPAN></SPAN>/0 proxy ID---- eventually it will pass all traffic through tunnel)<SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark"> .</SPAN></SPAN></SPAN></P><P style="font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; color: #3b3b3b;"></P><P style="font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; color: #3b3b3b;">But, if you configure a specific PROXY-ID, for example SRC-1.1.1.1/32 and DST-2.2.2.2/32 and then you may&nbsp; monitor the <SPAN style="color: #3b3b3b; font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;"> <EM><STRONG><SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark">encap</SPAN></SPAN></SPAN></STRONG></EM><STRONG><EM> packets</EM></STRONG></SPAN><STRONG><EM>/</EM></STRONG><SPAN style="color: #3b3b3b; font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;"><EM><STRONG><SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark">decap</SPAN></SPAN> packets</STRONG></EM></SPAN> counter to know whether PAN is receiving or sending as well<SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark"> .</SPAN></SPAN> <SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark">( </SPAN></SPAN></SPAN>Bidirectional flow).</P><P style="font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; color: #3b3b3b;"></P><P style="font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; color: #3b3b3b;">Thanks</P></BODY></HTML> Fri, 30 May 2014 20:54:51 GMT https://live.paloaltonetworks.com/t5/general-topics/tunnel-flow/m-p/25794#M18811 HULK 2014-05-30T20:54:51Z