topic Re: Ipsec VPN traffic issue in General Topics

Ipsec VPN traffic issue

Satish — Fri, 05 Sep 2014 11:40:47 GMT

why we are getting CISCOVPN traffic flow on VPN. please suggest.

Re: Ipsec VPN traffic issue

ajbool — Fri, 05 Sep 2014 11:55:02 GMT

Is the far end of the VPN a Cisco device?

Ciscos do advertise their vendor in the IKE exchange, you can se this in the 'less mp-log ikemgr.log' output:

2014-09-04 03:16:56 [INFO]: received Vendor ID: CISCO-UNITY

I think is is due to this that ciscovpn is selected as the application within the Palo Alto firewall.

Re: Ipsec VPN traffic issue

Satish — Fri, 05 Sep 2014 12:14:53 GMT

Hi Ajbool, Yes, End side is the cisco device and i have more then 100 tunnels but most of cisco but i am facing this issue is only 3-4 tunnel.i have all ready create a application overwrite policy but till, i am facing this issue. Thanks Regards Satish

Re: Ipsec VPN traffic issue

hshah — Fri, 05 Sep 2014 13:56:37 GMT

Hi Satish,

Please find analysis of application "ciscovpn"

The Cisco VPN Client allows organizations to establish end-to-end, encrypted VPN tunnels for secure connectivity for mobile employees or teleworkers.

Based on above analysis, there is a ciscovpn client which has generated remote access VPN request.

Can you confirm the same, via tracing source and destination.

Regards,

Hardik Shah

Re: Ipsec VPN traffic issue

HULK — Fri, 05 Sep 2014 14:48:06 GMT

Hello Satish,

If the IKE traffic is terminated on a Cisco device, it can contain a Cisco vendor ID field. If Cisco vendor ID field is seen in IKE packets by the AppID it will be identified as 'ciscovpn' application.

Reference DOC:

ciscovpn

Hope this helps.

Thanks

Re: Ipsec VPN traffic issue

Satish — Fri, 05 Sep 2014 15:50:40 GMT

HI Hulk Dud., You are right but question is that there are also other Cisco Tunnel but application identify as IPsec but few tunnel is identify as a CiscoVPN why??? Regards Satish

Re: Ipsec VPN traffic issue

HULK — Fri, 05 Sep 2014 16:10:38 GMT

Hello Satish,

In both cases, could you please apply >show session id xxxx and share the output.

Thanks