topic Re: Wire shark in General Topics

Wire shark

infotech — Wed, 16 Apr 2014 13:10:30 GMT

I am trying to troubleshoot why I am having issues with a certain VPN router device through the PA 3020 firewall, This is the message on the packet capture

ISAKMP Identity protection (main mode).

I am new to firewall and if there are any other troubleshooting methods I can use I would appreciate the advice. commands, gui anything

Re: Wire shark

ssharma — Wed, 16 Apr 2014 14:00:47 GMT

Hi Infotech,

If firewall is just a pass through device for vpn connection, you will only see encrypted packets in the packet capture. This packet will also be one of them. From PA's perspective, you can verify if the firewall is dropping any packets from source and destination in question. If not, you will have to look for vpn end devices. If firewall is dropping packets, we can further look at the counters to see reason behind it.

Re: Wire shark

infotech — Wed, 16 Apr 2014 14:34:23 GMT

Yes the VPN router just resides behind the firewall and goes through the firewall to a remote desitnation at a vendor location. The vendor say that the tunnel to our location are in an up/down state, and I am unable to ping,from command line on our server, their remote destination IP's. I am not sure if the firewall is blocking packets going in or out for sure not sure the best tool in the PA or outside the PA to determine that.

Re: Wire shark

ssharma — Wed, 16 Apr 2014 16:32:46 GMT

Hi Infotech,

You can do packet capture on PAN for the source/destination ip of VPN end points and see if there are any drops from PAN. That should verify if you need to look into other device. Here is a link to do pcap on PAN :

https://live.paloaltonetworks.com/docs/DOC-3265

Hope that helps.

Re: Wire shark

infotech — Wed, 16 Apr 2014 17:23:20 GMT

Thanks those were excellent step by step instructions on doing a packet capture, so now how do I interpret the information so I know what the issue is and how to fix it

Re: Wire shark

ssharma — Wed, 16 Apr 2014 19:37:45 GMT

Now, if you capture the traffic between the vpn end points (source and destination) on PAN and if you see any drops, that could be of concern and we have to see why PAN is dropping the packets. If we do not see any drops, then you can look for other device that might be causing the issue.