topic Re: Cisco AnyConnect over IKEv2 killed by PAN-OS 8.0 in General Topics

Cisco AnyConnect over IKEv2 killed by PAN-OS 8.0

GI-1 — Mon, 06 Feb 2017 08:17:49 GMT

Hi.

I've been running PAN-OS 8.0 since release, and immediately got problems with Cisco AnyConnect over IKEv2. Even if the session is very much alive, PAN-OS 8.0 kills it of after a random amount of time, usually a couple of hours.

If I change the AnyConnect policy to use SSL instead, everything runs fine.

PAN-OS 8.0 recognizes AnyConnect over IKEv2 as ipsec-esp-udp. Changing the default timeout to e.g. 86400 seconds changes nothing.

Re: Cisco AnyConnect over IKEv2 killed by PAN-OS 8.0

reaper — Mon, 06 Feb 2017 09:17:05 GMT

does the session indicate why it was terminated (idle, rst, ...) ?

Re: Cisco AnyConnect over IKEv2 killed by PAN-OS 8.0

GI-1 — Mon, 06 Feb 2017 16:51:37 GMT

PAN-OS says "aged-out". Cisco AnyConnect doesn't even notice that it's been disconnected.

Everything worked fine in 7.1.7 and earlier.

Btw, it's a PA-200.

Re: Cisco AnyConnect over IKEv2 killed by PAN-OS 8.0

BPry — Mon, 06 Feb 2017 17:13:25 GMT

Do you see anything in the Threat logs; it kind of sounds like some security policy is preventing the traffic from passing, hence your age-out response.

Re: Cisco AnyConnect over IKEv2 killed by PAN-OS 8.0

GI-1 — Tue, 07 Feb 2017 12:22:53 GMT

Hi.

No, there's no entries in the threat log with the IP to the AnyConnect server.

Re: Cisco AnyConnect over IKEv2 killed by PAN-OS 8.0

GI-1 — Wed, 08 Feb 2017 08:13:45 GMT

I see now that the apps and threats content release 658 did something to ipsec-esp-udp. I guess that's the culprit, and not necessarily 8.0.