topic Re: how to View Pre-Shared key in PA in General Topics

how to View Pre-Shared key in PA

iamvivekms — Mon, 14 Sep 2020 22:13:31 GMT

i'm have issues with IPSEC Tunnel which is configured by another engineer. currently facing issues with Tunnel connectivity and i need to cross verify the parameters. So can someone guide how to heck pre shared key in plain text format

@IPSec

Re: how to View Pre-Shared key in PA

BPry — Tue, 15 Sep 2020 03:34:25 GMT

@iamvivekms,

This isn't possible. You can't go back and get the clear text value for anything in the configuration when it comes to passwords, pre-shared keys or anything of the sort. The firewall simply stores hash or encrypted form of the value.

Re: how to View Pre-Shared key in PA

Abdul-Fattah — Tue, 15 Sep 2020 06:28:19 GMT

as @BPry said, but to verifiy if there is a mismatch you can use this command in CLI:

less mp-log ikemgr.log

Re: how to View Pre-Shared key in PA

A_Astardzhiev — Tue, 15 Sep 2020 13:37:31 GMT

@Abdul-Fattah , you will see "pre-share mismatch" only if the remote site is initiator of the tunnel negotiation and you are receiver. If you are the initiator you will only see "IKE phase1 timeout" message in the logs. This is caused by the nature of the IPsec

Re: how to View Pre-Shared key in PA

MP18 — Tue, 15 Sep 2020 14:24:04 GMT

@iamvivekms

If you see in logs as @A_Astardzhiev mentioned then best thing is to have new key on both ends.

Unless you can get the Pre-Shared key from other side of the connection.

Regards

Re: how to View Pre-Shared key in PA

iamvivekms — Tue, 15 Sep 2020 15:32:11 GMT

Thanks guys for your response...what i understand is that we have very limited options in Paloalto in terms of troubleshooting Tunnel down issues.. So i can go ahead and reconfigure Pre-shared key and test again.

Appreciated Everyone for your response !! @BPry @Abdul-Fattah @MP18

Re: how to View Pre-Shared key in PA

A_Astardzhiev — Tue, 15 Sep 2020 18:22:13 GMT

Hey @iamvivekms ,

I cannot agree with your statement - "we have very limited options in Paloalto in terms of troubleshooting Tunnel down issues"

It is quite the opposite:

1. Palo Alto is not the only vendor that does not store pre-shared key in plain text. It is actually way better to do it this way rather have it in plain text just because you lack proper documentation. Having the psk in plain-text for troubleshooting is like having your password written on sticky note on your monitor in case you forgot it...
Palo Alto firewall provides you several ways to troubleshoot IPsec tunnel. PAN is actually my favorite vendor for IPsec troubleshooting as it has excellent document and easy to use tools/commands.
1. You can check here for commands that you can use for debug/troubleshooting - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC
2. If you have multiple tunnels configured on your firewall it is recommended to enable tunnel debug only for specific peer - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcKCAS
3. You could also be useful for you - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PORsCAO
You need to remember that the receiver of the tunnel negotiation will log the actual reason for negotiation failure. So if you want to troubleshoot the tunnel at your end (on the Palo) you can "enable passive mode" under the IKE Gateway -> Advance options. This will force your firewall to only act as receiver and never as initiator for this peer. I believe Palo Alto TAC recommend this option only during t-shoot as it will cause traffic drop if your fw receive traffic that needs to be sent over the tunnel, but it is not established yet.

Wrong PSK is the most common mistake when configuring new tunnel so my suggest in this case is:

1. Re-Enter the psk again at your end of the tunnel.

2. Re-enter the psk at remote end of the tunnel

3. Agree on new psk