topic Re: Getting this from Vendor device eventid eq ike-recv-p1-delete in General Topics

Getting this from Vendor device eventid eq ike-recv-p1-delete

MP18 — Thu, 16 May 2019 15:18:36 GMT

After Phase 1 success as Responder in PA I am getting below event id

( description contains 'IKE protocol notification message received: INITIAL-CONTACT (24578).' )

and ( eventid eq ipsec-key-expire )

eventid eq ike-recv-p1-delete

description contains 'IKE protocol phase-1 SA delete message received from peer. cookie:5b34d3ab8d000c44:6d1b2079c0cb41f1

These steps are reoccuring every time

phase 1 success

and ( eventid eq ike-recv-notify )

and ( eventid eq ipsec-key-expire )

and ( eventid eq ike-send-p2-delete )

What can be reson for this?

Re: Getting this from Vendor device eventid eq ike-recv-p1-delete

gwesson — Thu, 16 May 2019 21:16:47 GMT

Are you actually experiencing a problem or are you just curious about the logs?

When the keys expire, a new one is received (ike-recv-notify), the old ones expire (ipsec-key-expire), and the old ones are deleted (ike-send-p2-delete).

My recommendation would be to set up a single firewall with a single VPN connection and watch the logs as it goes through its normal functions. When you have lots of tunnels, you'll see lots of messaging.

Re: Getting this from Vendor device eventid eq ike-recv-p1-delete

MP18 — Fri, 17 May 2019 01:17:33 GMT

we are having issues right now

Phase 1 is up Phase 2 is down

We habe single tunnel from PA to this device

Re: Getting this from Vendor device eventid eq ike-recv-p1-delete

BPry — Fri, 17 May 2019 03:16:12 GMT

@MP18 ,

I think what @gwesson was getting at with his message was essentially "have you verified all of the logs you are looking at are coming from the connection in question"? If not then I apologize for putting words on your keyboard @gwesson. If that's the case, they can come from mine.

Essentially if you are just looking at the event-ids and you have multiple tunnels on a device this isn't that helpful. You need to narrow the logs down to a single tunnel so you can start troubleshooting that connection. From all of the event-ids you have listed it's kind of unlikely they are all coming from the same connection with how fast the logs are said to be generating.

Re: Getting this from Vendor device eventid eq ike-recv-p1-delete

MP18 — Fri, 17 May 2019 03:34:54 GMT

Yes i have verified all the logs are from same tunnel.

That's the reason i am here to get help from you so that i can know the reason for this?

Re: Getting this from Vendor device eventid eq ike-recv-p1-delete

OtakarKlier — Fri, 17 May 2019 15:55:23 GMT

Hello,

I would suggest contacting support to see what is going on. Also if you could have someone that manages the other device on the line as well, it would make troubleshooting easier.

Regards,

Re: Getting this from Vendor device eventid eq ike-recv-p1-delete

MP18 — Fri, 17 May 2019 21:57:30 GMT

case is opened with support

still not going anywhere

Re: Getting this from Vendor device eventid eq ike-recv-p1-delete

MP18 — Mon, 20 May 2019 15:22:17 GMT

Seems REbooting the vendor device fixed the issue