topic Ipsec proxy Tunnel issue with multiple tunnels in General Topics

Ipsec proxy Tunnel issue with multiple tunnels

Venkatesan_radhakrishnan — Wed, 16 Jan 2019 05:59:26 GMT

HI Team,

I have configure Ipsec between PA and Cisco ASA, IPSEC is up but not traffic is passing.

During the troubleshooting I have found for the proxy ID's configure in palo alto for some of the proxy id's only encapulation packet paloalto is sending and there is no decapusulation packet increasing for the proxy tunnel.

But in the same Ipsec tunnel other proxy ID's are working fine. My firewall is running 8.0.13 which is recommened by Palo alto.

Replay protection is already disabled, Phase 1 is having 24 hours and Phase 2 has 1 hour life time.

I'm not seeing issue in negotiation, The proxy tunnel which is having issue is in the init state in PA side when analysing through command show vpn ikesa gateway gatewayname.

Please suggest what can be done further to check this issue.

Regards

Venky

Re: Ipsec proxy Tunnel issue with multiple tunnels

Venkatesan_radhakrishnan — Tue, 22 Jan 2019 07:19:09 GMT

HI Guys,

Do anyone able to get my issue

Re: Ipsec proxy Tunnel issue with multiple tunnels

aleksandar.astardzhiev — Tue, 22 Jan 2019 09:32:24 GMT

Hi @Venkatesan_radhakrishnan,

If you can see statistics for encrypted packets, this means that the IPsec SA for the problematic proxy ids are successfully negotiated and Palo Alto firewall is actually sending traffic through the tunnel.

So I would say that your problem is most probably on the other and of the tunnel - on the ASA. IPsec SA are up, which means the VPN settings are correct, BUT: Can you confirm that the traffic from the tunnel is allowed on the ASA? Can you confirm the rest of the path has a correct route back to the ASA? Is there any NAT applied on the tunnel traffic on the ASA?

Having the fact that you have some proxy ids up and running eliminates any issues with phase1 setting and peer reachability
Having the fact that the problematic proxy ids are also up, but you see only uni-directional traffic eliminates any issues with phase2 encryption domains/selectors.

Re: Ipsec proxy Tunnel issue with multiple tunnels

Venkatesan_radhakrishnan — Tue, 22 Jan 2019 09:39:29 GMT

HI Alex,

Thanks for your reply, I will look on the ASA side.

I can understand this point Can you confirm the rest of the path has a correct route back to the ASA

I will check the remaning asap.