topic IPsec VPN with AH generates core files in General Topics

IPsec VPN with AH generates core files

Karim.Benyelloul — Tue, 14 May 2019 15:14:27 GMT

Hi team,

I have two VM-50 v9.01, one in SiteA and another in SiteB. I set up an IPsec tunnel between them with: IKE-v1 : phase1 (aggressive mode) and phase2 (quick mode) with ESP. it works fine and I'am able to ping from a vlan in SiteA to another vlan in SiteB .

I wanted to test AH instead of ESP. However everytime I want to send a ping from SiteA to SiteB, the firewall in SiteB craches and generates a core file.

If I perform a "test vpn ike-sa gateway mygateway" and "test vpn ipsec-sa myipsec" it works fine and I can see the SA created in both firewall. However when I send a packet from SiteA to SiteB, I can see the packet leaving firewall in SiteA with the apropriate AH header inserted. But as soon as the packet arrives in the firewall in SiteB, it craches.

I can provide pcaps and core files , or anything you may need to help me.

Does anybody try to do the same ?

Any help would be appriciated

Many thanks

Re: IPsec VPN with AH generates core files

BPry — Tue, 14 May 2019 16:50:42 GMT

It would be odd to have two PA devices utilize AH. I would open a ticket with support and see if they can duplicate the issue; it sounds like it may be a bug with 9.0

Re: IPsec VPN with AH generates core files

Karim.Benyelloul — Mon, 20 May 2019 08:34:13 GMT

Hmmm as I said in my description I am in a lab environment and I wanted to test different configuration to make sure that I'm doing things right, I don't think that the support would accept my issue as a "ticket" ... It would be nice if anyone could try to setup AH between two Paloaltos and keep me in touch if it works for him.

Many thanks,