topic GRE Tunnel Interference in General Topics

GRE Tunnel Interference

ChrisRussell — Tue, 25 Apr 2017 16:15:51 GMT

Has anyone seen interferrence with GRE tunnels passing through PANFW's set up in virtualwire for passive IDS? The policies are all any, any, any etc and there is no inspection configured? I've read NAT'ing issues may have something to do with it, but not sure why that would be required for a passive set up.

Re: GRE Tunnel Interference

Raido_Rattameister — Tue, 25 Apr 2017 16:24:08 GMT

Are you applying NAT for virtualwire traffic?

Re: GRE Tunnel Interference

ChrisRussell — Thu, 27 Apr 2017 20:10:04 GMT

No.

Re: GRE Tunnel Interference

BPry — Thu, 27 Apr 2017 20:59:03 GMT

I've never seen it cause any issues for anything like that unless it's getting logged as a threat or something like that. Especially in a virtualwire setup it really shouldn't be interfacing any of your traffic.

Re: GRE Tunnel Interference

ChrisRussell — Fri, 28 Apr 2017 14:35:02 GMT

I agree, and I think I'll be able to prove its not the Palo, but right now thats the only new thing in the environment so its the obvious target for blame.

Re: GRE Tunnel Interference

Raido_Rattameister — Fri, 28 Apr 2017 17:04:13 GMT

Just run packet capture on "receive" and "transmit" states on Palo and you can verify if pacet it received on one side was sent out exactly the same.

If packet was dropped then "drop" state will capture them.

https://live.paloaltonetworks.com/t5/Management-Articles/Using-Packet-Filtering-through-the-WebGUI/ta-p/56363

Re: GRE Tunnel Interference

ChrisRussell — Mon, 01 May 2017 13:52:47 GMT

Thanks. I just don't have access to the box yet, which is why I was seeing if anyone had experience with a similar issue. Once I can run some PCAPs, it will be clear. Thanks again for taking the time to help!