topic Re: Cisco VPN traffic in General Topics

Cisco VPN traffic

jdprovine — Thu, 28 Jan 2016 13:33:56 GMT

If a vpn tunnel has been successfully established from a cisco device and passing through the PA firewall, is it possible for the PA to still drop the traffic destined for the established tunnel?

Re: Cisco VPN traffic

OtakarKlier — Thu, 28 Jan 2016 14:20:28 GMT

I think the answer there is 'it depends'.

I'm my scenario, I have a different zone for the other side of the VPN tunnel so if there is no security policy, then yes it will get dropped.

Re: Cisco VPN traffic

syadav — Thu, 28 Jan 2016 14:22:03 GMT

@jdprovine The traffic on PA would be seen as either ESP or ESP-UDP, can you check in the traffic logs on the PA if this traffic is seen ? To ensure you have PA as passthrough allow application "IPSEC" as suggested in below DOC :

https://live.paloaltonetworks.com/t5/Configuration-Articles/Configuring-the-Palo-Alto-Networks-Device-as-an-IPSec/ta-p/58732

Re: Cisco VPN traffic

jdprovine — Thu, 28 Jan 2016 14:23:08 GMT

Thanks I will check it out

Re: Cisco VPN traffic

jdprovine — Thu, 28 Jan 2016 19:13:23 GMT

It appears that there was a open session that never ended. I went into session browser, manually ended the session, a new session started and it began to pass traffic