topic How VPN test commands work in General Topics

How VPN test commands work

palomed — Sun, 16 Apr 2017 22:42:46 GMT

What happens behind the scenes when you run..

test vpn ike-sa gateway <name>

test vpn ipsec-sa tunnel <name>

Is there a debug which will show you the test packets sent/received?

Re: How VPN test commands work

Raido_Rattameister — Mon, 17 Apr 2017 03:08:08 GMT

test vpn ike-sa gateway <name>

Will negotiate VPN Phase 1 with VPN Peer.

test vpn ipsec-sa tunnel <name>

Will negotiate VPN Phase 1 and if this is successful then Phase 2 with VPN Peer.

If you troubleshoot VPN and try to initiate traffic from workstation they you have to have routing and firewall rules correct.

Using those commands help you to verify if underlying VPN is set correctly without checking routing or security policies.

If you use those commands then your firewall is initiator. If VPN config does not match then responder does not tell you what is wrong so not much troubleshooting you can do at initiator side.

If Palo is responder then you can take packet capture to troubleshoot Phase 1 settings and ike pcap to troubleshoot Phase 2.

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Troubleshoot-IPSec-VPN-connectivity-issues/ta-p/59187

Re: How VPN test commands work

TranceforLife — Mon, 17 Apr 2017 10:22:44 GMT

In addition to the @Raido_Rattameister comment, VPN the only effective way to troubleshoot is to check the logs from the responder side. Responder side will say why VPN is failing and record everything into the log file but it will not send this info to the initiator. This is per design. Similar we can compare when we submitting our credentials to the other side. We only see a message "your username or password is incorrect". But another side has all records exactly why.