topic Re: Issue with traffic over ipsec tunnel. in General Topics

Issue with traffic over ipsec tunnel.

inderjit21 — Sun, 02 Apr 2017 03:27:29 GMT

PA-3020 ,7.1.8. PA has 3 tunnels with 3 sites.

Site1 - PA200 on other side tunnel traffic fine. ping from site1 to subnet behind Pa3020 works with 1472 mtu and fails after

that.

Site2- Tried to migrated from ssg140 to PA-3020,other side Cisco 871. Traffic from PA-3020 to Site2 works fine.

But from Site2 to PA3020 can only ping. rdp,mail,port 80 traffic not working.

ping from site2 to subnet behind pa3020 works with 1394 mtu and fails with mtu above that.

Site3-Same issue as Site2 ,but mail worked. rdp,port 80 traffic not working.

ping from site 3 to subnet behind pa3020 works with 1410 mtu and fails with mtu above that.

PA3020 traffic logs shows just minimal byte traffic compared to working tunnel where after initial tcp handshake traffic flows.

Also packet capture shows retransmissions.

ssg140 has set flow tcp-mss.

All the tunnels have 1500 MTU size with no mss setup.

TranceforLife — Mon, 03 Apr 2017 15:25:40 GMT

Hi,

Are you able to log this with support? This one is not the easy one and require some expertise. You will get definitely quicker resolution.

ansharma — Mon, 03 Apr 2017 19:08:13 GMT

Hi Inderjit,

When you initiate the problem traffic from site 2 and 3, check if the session is getting formed or not.

> show session all filter source x.x.x.x destination y.y.y.y

Regards,

Anurag