topic Re: nat-t not enabled on vpn tunnel has impact on other tunnels in General Topics

nat-t not enabled on vpn tunnel has impact on other tunnels

VARNObit — Fri, 23 Mar 2018 08:45:00 GMT

i just had a weird behavior. i have several ipsec tunnels for clients using the ncp secure entry client.

they all have tunnels configured with certificates and a dynamic peer ip. yesterday i created two new tunnels but forgot to check the nat-t checkbox. and some of the users couldn't get a connection via rdp. my understanding was that it shouldn't impact other vpn tunnels as they established the connection to the correct tunnel with nat-t enabled. i don't know if its really the nat-t checkbox but it was the only difference to the other tunnels i configured.

pan os version is 8.0.5 and app version is 793-4594.

is this a design failure?

Re: nat-t not enabled on vpn tunnel has impact on other tunnels

SARowe_NZ — Sun, 25 Mar 2018 20:55:47 GMT

Hi,

Sorry I think a bit more clarity is required.

If NAT-T is required, but not enabled, the ipsec/phase2 should not stand up at all and your users wouldn't be able to get at anything (not simply RDP). NAT-T should impact the establishment of your new tunnels, I don't see how (short of a very unusual bug) that it would affect encap traffic inside another tunnel.

Did the new tunnels fully establish?
Could users access services over the new tunnel?
Were services other than RDP affected on the other (historical) tunnels?
Have you done a config audit and compared the last known working config, to the new config to verify that that was the only change?
Are all your tunnels using static peer IP addressing, or are some of them configured as dynamic?

Thanks,

Shannon

Re: nat-t not enabled on vpn tunnel has impact on other tunnels

VARNObit — Mon, 26 Mar 2018 06:15:59 GMT

Hi Shannon,

thank you for your help.

to answer your questions.

1. i could not test the new tunnels, because i was not at customers side and i can not use the ncp client anymore (have no license)

2. could also not be tested

3. yes even a ping does'nt go through the tunnel. But there were other tunnels that were not affected and worked properly.

4. i compared the configuration of other tunnels to the new tunnels and this was the only difference. as soon as i disabled the new tunnels everything worked just fine again.

5. the tunnels using ncp as client are all dynamic

Kind Regards,

Gregor