topic Re: PA to ASA Proxy-ID Mismatch in General Topics

PA to ASA Proxy-ID Mismatch

cenduit_jgolden — Fri, 30 Mar 2018 17:15:17 GMT

Hi all,

We have a standard IPSec tunnel one of our smaller sites with a strange issue related to the Proxy-IDs defined on the PA side of the tunnel. Our ASA side (10.7.0.0/16) is set to inherit all policy settings from the PA side, and our PA defines the "policies" with the Proxy-ID. Normal behavior with a policy based firewall (ASA) and a route based firewall (PA).

The issue is that while two of the networks defined on the PA side Proxy IDs are match the tunnel details on the ASA, the third network does not. Traffic from the 10.0.0.0/8 and 192.168.0.0/16 supernets is allowed over the tunnel without issue; however, the 172.16.0.0/12 supernet shows up on the ASA's as a smaller, but valid, subnet within the 172.16.0.0/12 supernet and only to one specific host. This is preventing anything in our 172 networks from accessing the site due to a mismatch in the negotiated session.

A quick note. Our PA is using SW version 7.1.10. In this version, we have seen some "ghosting" where some changes are not properly removed from the config file; as in objects still existing after removal, routes existing after removal, etc, so this may be related. We are upgrading this OS during our next maintenance window to 7.1.16.

Screenshots are below. I have also used proxy-ID local 0.0.0.0/0 but the results remain unchanged.

All of the networks match the PaloAlto Proxy-IDs except for the 172 network.

Thank you!

- Edit: a word

Re: PA to ASA Proxy-ID Mismatch

Remo — Fri, 30 Mar 2018 17:13:29 GMT

Hi @cenduit_jgolden

Probably the only solution for you is upgrading to something higher than 7.1.10. The issue you are facing is fixed in 7.1.11.

PAN-77127
Fixed an issue where the firewall reduced the range of local and remote
IKEv2 traffic selectors in a way that disrupted traffic in a VPN tunnel
that a Cisco Adaptive Security Appliance (ASA) initiated.

So upgradin to 7.1.16 is a good idea, that will solve the issue.

(https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os-release-notes/pan-os-7-1-11-addressed-issues#_11590).

Another workaround would be changing the tunnel to IKEv1.

(Ok, there is a very little chance that you have found another problem, but I am pretty sure that your issue is fixed after the upgrade becaue I had exactly the same issue a while ago)

Regards,

Remo

Re: PA to ASA Proxy-ID Mismatch

cenduit_jgolden — Fri, 30 Mar 2018 17:16:23 GMT

Thanks for the insight Remo. I'll monitor this and update the post once we have upgraded.

Cheers!

-josh

Re: PA to ASA Proxy-ID Mismatch

cenduit_jgolden — Tue, 24 Apr 2018 16:22:31 GMT

Hi Remo,

After updating our firewall cluster to 7.1.16, the issue with ProxyID mismatch has been resolved. Thanks for the help!

-josh