VPN Encryption/Authentication key's for Wireshark Decryption

debsPal0 — Fri, 04 Apr 2014 09:21:26 GMT

It is possible to debug ESP packet's in Wireshark but to do so I will need to obtain the encryption key and the authentication key for the given VPN from my Palo Alto 5050. As an example - In Linux it's possible to get this information by running the command 'ip xfrm state':

gw205:/ # ip xfrm state

src 192.168.140.200 dst 192.168.140.205

proto esp spi 0x0879355b reqid 16421 mode tunnel

replay-window 32 flag noecn nopmtudisc af-unspec

auth hmac(sha1) 0xb8dd42a1c505bed19c2bf23cef00e5d8223c2a5b

enc cbc(des3_ede) 0xae76ea430b10c72c882c4aeab2283444c54f913d87f5e109

src 192.168.140.205 dst 192.168.140.200

proto esp spi 0x1c0d7b38 reqid 16421 mode tunnel

replay-window 32 flag noecn nopmtudisc af-unspec

auth hmac(sha1) 0xc364660133b04a4f20e52000dbe4a6ba154c09c1

enc cbc(des3_ede) 0x39e87c9ca500616b36f2f0d3c7fb688621d7bbf31414abbd

Does anyone know how can I obtain this information from my Palo Alto 5050? I have tried all of the show vpn / ike-sa / ipsec-sa commands but none of them show me what I need.

For reference, here is a link to the Wireshark guide that I have been using:

How can I decrypt IKEv1 and/or ESP packets ? - Wireshark Q&A

Regards,

James.

Re: VPN Encryption/Authentication key's for Wireshark Decryption

debsPal0 — Thu, 10 Apr 2014 12:31:01 GMT

Can anyone help with this one?

topic VPN Encryption/Authentication key's for Wireshark Decryption in General Topics

VPN Encryption/Authentication key's for Wireshark Decryption

Re: VPN Encryption/Authentication key's for Wireshark Decryption