topic Re: PANOS-8.0 broke IPSec XAuth VPN? in General Topics

PANOS-8.0 broke IPSec XAuth VPN?

RahmanDuran — Fri, 24 Feb 2017 18:44:34 GMT

Hi,

After I upgraded to our PA-3050 to PANOS-8.0, ios and android native clients (using ipsec xauth) don't work anymore. These clients can authenticate successfuly and get a valid IP from the gateway ip pool. But after this they can't access anything. There is no traffic logs shown with the vpn ip either.

Anybody using 8.0 can test if ipsec xauth is functional to see if its 8.0 upgrade or something else is wrong with my setup.

Thanks,

Rahman

Re: PANOS-8.0 broke IPSec XAuth VPN?

sullivanpj2 — Fri, 24 Feb 2017 20:19:30 GMT

Updating to 8.0 has a huge amount of risks for any production environment. The code is brand new and I would only recommend it in lab devices. It you updated and it broke things, you'll have to report it to support and let them know that is broke something. This kind of thing will most likely go on until 8.0.6.

- Peter

Re: PANOS-8.0 broke IPSec XAuth VPN?

Retired Member — Fri, 24 Feb 2017 23:17:33 GMT

we have the same issue

Regards

Re: PANOS-8.0 broke IPSec XAuth VPN?

RahmanDuran — Tue, 21 Mar 2017 05:58:43 GMT

Can anybody test if 8.0.1 fixed the issue?

Thanks,

Rahman

Re: PANOS-8.0 broke IPSec XAuth VPN?

JoaoCesar — Fri, 23 Jun 2017 19:21:40 GMT

Has anyone managed to solve this problem?

Re: PANOS-8.0 broke IPSec XAuth VPN?

BPry — Fri, 23 Jun 2017 20:16:15 GMT

@JoaoCesar,

I would harbor a guess that you will need to update to 8.0.2 if this is fixed in the 8.0 code yet.

Re: PANOS-8.0 broke IPSec XAuth VPN?

TranceforLife — Fri, 23 Jun 2017 22:16:10 GMT

Yeah, 8.0.0 can be fun:

https://live.paloaltonetworks.com/t5/General-Topics/Native-VPN-client-on-android-phone/m-p/161374#M52504

Re: PANOS-8.0 broke IPSec XAuth VPN?

JoaoCesar — Mon, 26 Jun 2017 11:56:44 GMT

Some phone models connects and receives an IP-Pool IP but it cannot reach the internal resources.

Motorola Moto Z Android 7 -> problem
Motorola Moto G3 Android 6 -> probelm
Motorola Moto Maxx Android 6 - > problem
Lenovo Vibe K6 Android 6 -> problem

Samsung Galaxy S7 Android 7 -> OK
Samsung Galaxy S4 Android 5.1 -> OK
Iphone 4 iOS 7 -> OK

Test with PAN-OS 8.0.2 and 8.0.3.

Re: PANOS-8.0 broke IPSec XAuth VPN?

TranceforLife — Mon, 26 Jun 2017 14:24:37 GMT

Hi,

ls there a useful info in the ikemgr.log file:

> tail lines 100 mp-log ikemgr.log

Did you try to re-create a VPN profile on the affected client mobile phones?

Re: PANOS-8.0 broke IPSec XAuth VPN?

tlanlan — Sat, 21 Oct 2017 10:39:06 GMT

I have same issue like this, I tried Huawei P9 andriod 7.0, SAMSUNG S7edge 7.0 sometime work , some time not. PAN-OS 8.0.4，7.1.11，7.0.12 same issue.

Re: PANOS-8.0 broke IPSec XAuth VPN?

DonohoeRobert — Sat, 21 Oct 2017 19:56:30 GMT

Hi Guys,

We observed this for some users. Seems to be a recurrance of a previous bug.

Double check the auth type is 'Any' not 'any' for the portal config.

If using loopbacks for the portal can be an issue at previously , tested on 8.0.5 on pa-220 just now and connects fine with a loopback.

in the config double check the auth type has capital 'A'.

<global-protect-portal>
<entry name="external">
<portal-config>
<local-address>
<ip>
<ipv4>10.10.24.1</ipv4>
</ip>
<interface>loopback.1</interface>
</local-address>
<client-auth>
<entry name="local">
<os>Any</os>
<authentication-profile>local</authentication-profile>
<authentication-message>Enter login credentials</authentication-message>
</entry>
</client-auth>
<ssl-tls-service-profile>brookfieldlab</ssl-tls-service-profile>
</portal-config>
<client-config>
<configs>
<entry name="configGP">
<gateways>
<external>
<list>

added edit ;

double check the gateway config has a capital A as well.. 🙂

> configure
# set global-protect global-protect-gateway <gateway_name> client-auth <client_auth_name> os Any
# commit

best regards,

Rob

Re: PANOS-8.0 broke IPSec XAuth VPN?

RahmanDuran — Mon, 23 Oct 2017 06:34:27 GMT

Hi,

This problem is not related to old bug that you mention. I have capital A in the portal/gateway configs and still has the issue.

global-protect-portal {
GP-Portal {
portal-config {
ssl-tls-service-profile web-gui-ssl-profile;
client-auth {
"Local&LDAP for Admins" {
os Any;
authentication-profile auth-sequence-gp;
authentication-message "Enter login credentials";
}
}

# show global-protect global-protect-gateway GP-EXT-XAuth-RSA
GP-EXT-XAuth-RSA {
roles {
default {
login-lifetime {
days 30;
}
inactivity-logout {
hours 3;
}
disconnect-on-idle {
minutes 180;
}
}
}
client-auth {
admins&standard-users {
authentication-profile auth-sequence-gp;
os Any;
authentication-message "Enter login credentials";
}
}

With 8.0.5:

-stock/stock like android 6.0 devices connect to VPN but no traffic passes, all traffic timeout on client side and there is no indication on PANOS logs that client traffic hits PANOS.

-Samsung android 7 devices connects to VPN but none of the traffic routed through VPN.

-LineageOS android 7 device works as expected.

Regards,

Rahman

Re: PANOS-8.0 broke IPSec XAuth VPN?

PanIst — Tue, 24 Oct 2017 08:09:45 GMT

Hi,

we have a case for this issue.TAC found the issue.

Fixed release is not known yet.

https://bugs.libreswan.org/show_bug.cgi?id=251

Regards

Re: PANOS-8.0 broke IPSec XAuth VPN?

Frazão — Mon, 22 Jan 2018 13:53:13 GMT

we have the same issue

Regards

Re: PANOS-8.0 broke IPSec XAuth VPN?

jdprovine — Mon, 22 Jan 2018 14:09:56 GMT

@RahmanDuran

Is this only phone access on native client or also for pc's native access?

Re: PANOS-8.0 broke IPSec XAuth VPN?

SergioAfonso — Mon, 29 Jan 2018 14:49:04 GMT

Hi,

I have found the problem with PAN-TAC. It happen in all PANOS 8.0 version and theGlobalProtect IPSec Crypto, now doesn´t support sha256, and all new Android phone from version 6 only use sha256. If you test with an Android version 5 will work fine. I don´t know why PaloAlto erase this option.

PAN-TAC said me, that they are working in a new feature to introduce the sha256 in news version, maybe in PANOS 8.0.8, but it is no sure.

When you connect an Andrroid in version 6 or later, if you use show vpn ipsec-sa command, you can see how the negotiation is sha256

Best Regards

Sergio

Re: PANOS-8.0 broke IPSec XAuth VPN?

jdprovine — Mon, 29 Jan 2018 16:19:32 GMT

@SergioAfonso

So this is only an issue with phones not laptops or pc's

Re: PANOS-8.0 broke IPSec XAuth VPN?

SergioAfonso — Mon, 29 Jan 2018 16:33:47 GMT

Hi,
I have some similar issues with some versions if Linux, but I have to confirmated yet. DO you
have problems with PCs?

Best Regards
Sergio

Re: PANOS-8.0 broke IPSec XAuth VPN?

jdprovine — Mon, 29 Jan 2018 19:30:08 GMT

@SergioAfonso

I haven't upgraded to 8 yet I am just gather information at this time, but if it break the VPN in anyway I want to know about it and how to fix it

Re: PANOS-8.0 broke IPSec XAuth VPN?

DonohoeRobert — Mon, 29 Jan 2018 21:51:30 GMT

Hi Guys,

Interesting one, tested again on 8.0.7 , no joy for android 6. IOS devices connect fine with the xauth. Client works best always anyways if the licence.

Have ye tried cert authentication for the androids on 6.0. Will check tomorrow, but with the cert based auth/client certs can have sha 256 if androids need that.

Might be a workaround to get ye out of the woods.

The gp client connects fine anyways, no licence needed for the gp client on version 8 on windows or macbooks. and IOS devices connecting fine using xauth from a quick check..

best regards,

Rob