topic Re: Port 4500 ipsec/udp traffice in General Topics

Port 4500 ipsec/udp traffice

infotech — Tue, 05 Aug 2014 15:52:05 GMT

How do I check to see it the PA is dropping port 4500 traffic?

Re: Port 4500 ipsec/udp traffice

hshah — Tue, 05 Aug 2014 15:58:41 GMT

Hello Infotech,

There are mulitple ways to do so.

1. Packet capture with proper source/destination IP/Port.

2. From Traffic log

3. show session all filter source <> destination <> source-port <> and destination-port <>

Let me know if you need additional information.

Regards,

Hardik Shah

Re: Port 4500 ipsec/udp traffice

infotech — Tue, 05 Aug 2014 16:54:12 GMT

I see no port 4500 traffic at all, I don't see anything being blocked to or from port 4500

Re: Port 4500 ipsec/udp traffice

hshah — Tue, 05 Aug 2014 16:56:32 GMT

Can you do packet capture on firewall to make sure, no other device is blocking traffic for port 4500 inbetween.

Re: Port 4500 ipsec/udp traffice

infotech — Tue, 05 Aug 2014 16:58:38 GMT

I did a packet capture and I see no 4500 traffic present, blocked or anything else. the source is also from a remote vendor in the internet. I am see the ike 500 traffice going out from the vpn device and nothing else

Re: Port 4500 ipsec/udp traffice

hshah — Tue, 05 Aug 2014 17:00:29 GMT

Hi Infotech,

It means PAN is not receiving traffic on port 4500.

Can you check on other end firewall if its sending any traffic on port 4500 ?

Regards,

Hardik Shah

Re: Port 4500 ipsec/udp traffice

infotech — Tue, 05 Aug 2014 17:02:43 GMT

So that means its not an issue on the PA but an issue outside in the internet or the sender. The sender says that don't see any ike 500 traffice to respond too. I will see if I they can send some 4500 traffic

Re: Port 4500 ipsec/udp traffice

mrajdev — Tue, 05 Aug 2014 17:14:23 GMT

Can you also please check if you have any implicit deny rule configured at the bottom of the rule base on the PA. This at times may cause some unintended issues for traffic terminating on the device.

Re: Port 4500 ipsec/udp traffice

infotech — Tue, 05 Aug 2014 17:23:45 GMT

I have a clean up rule at the bottom but wouldn't it show up in the logs as dropped?

Re: Port 4500 ipsec/udp traffice

hshah — Tue, 05 Aug 2014 17:24:57 GMT

Hi Infotech,

Upload complete capture from PANW. I think something in between is not allowing packets on both 500/4500.

Regards,

Hardik Shah

Re: Port 4500 ipsec/udp traffice

HULK — Tue, 05 Aug 2014 17:41:58 GMT

Hello Infotech,

Please make sure NAT-traversal is enabled on both side firewalls to accept IKE on port 4500. During IKE negotiation, 3rd message onwards, port will flip to UDP 4500.

Traditionally, IPSec does not work when traversing across a device doing NAT. To circumvent this problem, NAT-T or NAT Traversal was developed. NAT-T is an IKE phase 1 algorithm that is used when trying to establish a VPN between two gateways devices where a NAT device exists in front of one of the devices.

Thanks.

Re: Port 4500 ipsec/udp traffice

infotech — Tue, 05 Aug 2014 18:02:19 GMT

I dont' have any control over the remote site, but if I am able to send 500 ike traffice out into the internet and am not seeing 4500 traffic traying to come in not sure how nat-t would affect it

Re: Port 4500 ipsec/udp traffice

infotech — Tue, 05 Aug 2014 18:13:33 GMT

I do not have nat-t enabled on the palo side

Re: Port 4500 ipsec/udp traffice

HULK — Tue, 05 Aug 2014 18:18:59 GMT

If NAT-T is not enabled on PAN firewall, then could you please let us know, why are you expecting traffic on port 4500..?

Thanks

Re: Port 4500 ipsec/udp traffice

infotech — Tue, 05 Aug 2014 18:23:48 GMT

I have a vendor that creates a vpn tunnel using a fortinet device behind our PA 3020. The device initiates the tunnel,the ike 500 traffic I am seeing passing throught the PA into the internet, Then I would assume a device on the vendors side exchanges SA's with the 500 traffic should say okay and builds the ipsec/udp tunnel using port 4500. I am trying to confirm that we are making in past the pa firewall into the internet and not blocking a response from the vendor

Re: Port 4500 ipsec/udp traffice

HULK — Tue, 05 Aug 2014 19:38:12 GMT

is the VPN terminates on PAN FW...?

Thanks

Re: Port 4500 ipsec/udp traffice

infotech — Tue, 05 Aug 2014 19:42:01 GMT

I don't understand the question.

Re: Port 4500 ipsec/udp traffice

HULK — Tue, 05 Aug 2014 19:45:12 GMT

Is the VPN tunnel configured with PAN firewall or it's just a pass through device..?

Thanks

Re: Port 4500 ipsec/udp traffice

infotech — Tue, 05 Aug 2014 19:47:17 GMT

It just passes throught the PA.

Re: Port 4500 ipsec/udp traffice

HULK — Tue, 05 Aug 2014 19:50:11 GMT

Ok, then nothing has to be done on the PAN firewall apart from a general security policy etc.

You can check the real time session in the CLI by using 'show session all filter source IP_ADD_OF_THE_TESTING_PC destination IP_ADD_OF_THE_DESTINATION'.

> If there is a session exist for the same traffic, then please apply CLI command PAN> show session id XYZ >>>>>>>> to get detailed information about that session, i.e NAT rule, security rule, ingress/egress interface etc.

Thanks