topic Re: Unstable ipsec detection for ipsec-esp-udp application when connecting Globalprotect VPN in General Topics

Unstable ipsec detection for ipsec-esp-udp application when connecting Globalprotect VPN

Trond.Olsen — Fri, 14 Jul 2017 07:19:16 GMT

We have a setup with a primary PA firewall 1 that pass through Globalprotect VPN traffic to a second PA firewall 2. We've seen sporadic connection problems when connecting a Globalprotect client. Sometimes it can spend up to 2 minutes to establish the VPN. When these connection problems occur firewall 1 will log unknown-udp on port 4501. Besides allowing any application with service ports in the Globalprotect policy, is it possible to improve reliability when using ipsec application?

Re: Unstable ipsec detection for ipsec-esp-udp application when connecting Globalprotect VPN

TranceforLife — Fri, 14 Jul 2017 08:14:51 GMT

Hi,

Any particular clients facing this issue?

Re: Unstable ipsec detection for ipsec-esp-udp application when connecting Globalprotect VPN

Trond.Olsen — Mon, 17 Jul 2017 08:25:58 GMT

This is on Windows 64-bit using the latest client software.

Re: Unstable ipsec detection for ipsec-esp-udp application when connecting Globalprotect VPN

TranceforLife — Mon, 17 Jul 2017 18:27:23 GMT

Hi,

It is hard to conclude based on this info. In your GP policy, do you have services as "any" or "application-default"? Do you have an ability to raise the TAC case providing them with the PCAP from the firewall when the issue is visible?

Re: Unstable ipsec detection for ipsec-esp-udp application when connecting Globalprotect VPN

BPry — Mon, 17 Jul 2017 20:15:44 GMT

@Trond.Olsen,

This should be a fairly stable signature; I would raise a case with TAC and see if they could work with you on it.

Re: Unstable ipsec detection for ipsec-esp-udp application when connecting Globalprotect VPN

Trond.Olsen — Tue, 18 Jul 2017 06:24:25 GMT

@TranceforLife
Policy was initially configured with default-application. We've experienced better reliabilty using service ports instead. Still get sporadic VPN connections thats logged as unknown-udp on port 4501 though but it working.

Also forgot to mention that there is a destination NAT policy involved.

@BPry
Its a bit hard to do packet capture since vpn connections generate so much data. We've got no reliable way to reproduce unknown-udp application detection. But I'll keep it in mind in case we have do to some further digging.

Re: Unstable ipsec detection for ipsec-esp-udp application when connecting Globalprotect VPN

TranceforLife — Tue, 18 Jul 2017 12:03:32 GMT

Hi,

l don't think DNAT should or causing issues. If application is identified incorrectly (unknown-udp it is also app within the database) then TAC case is the next destination 😄 Please post the outcome

Re: Unstable ipsec detection for ipsec-esp-udp application when connecting Globalprotect VPN

Trond.Olsen — Tue, 28 Nov 2017 09:33:31 GMT

An update: This was a hard to replicate APP-ID misidentification but got fixed in content update 752-4343.