Tunnel times

Reply
L4 Transporter

Re: Tunnel times

The command we have to verify ike-mgr.log from cli ( > less mp-log ike-mgr.com [Shift+G]) did not work got invalid syntax

L7 Applicator

Re: Tunnel times

Hello Infotech,

Open a new cli session and run > tail follow yes mp-log ikemgr.log. At the same time, try the TEST VPN command from an another window (forcefully initiate the VPN tunnel).

Thanks

L4 Transporter

Re: Tunnel times

These are the results

2014-07-16 14:36:04 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS INITIAT                                                                             OR, (QUICK MODE) <====

====> Initiated SA: 66.94.196.107[500]-66.94.196.108[500] message id:0xDCA8EE4B                                                                              <====

2014-07-16 14:36:04 [PROTO_NOTIFY]: notification message 14:NO-PROPOSAL-CHOSEN,                                                                              doi=1 proto_id=3 spi=3fd430494385e0f5 1df66859af85187f (size=16).

2014-07-16 14:36:05 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <====

====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:3fd430494385e0f5:1df66859af85187f <====

2014-07-16 14:36:13 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <====

====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:0e8b02a666f3d3b1:cedef558e2c21a7e <====

2014-07-16 14:36:14 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <====

====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:2931850b7ade2be4:b5eeafc08a33ee7b <====

2014-07-16 14:36:15 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <====

====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:3fd430494385e0f5:1df66859af85187f <====

Highlighted
L4 Transporter

Re: Tunnel times

What type of firewall is the peer device?

The message above is indicating that the IPSec settings are not matching on the firewalls. What is the IPSec profile you are using on your local systems and what is the configuration of the remote host?

L4 Transporter

Re: Tunnel times

Peer is a cisco 5505 and I have checked rechecked and changed the settings to make it match and it always does the exact same thing no matter what the seeting are.

L3 Networker

Re: Tunnel times

Be deafult Perfect Forward Secrecy (PFS) is enabled on the Palo.

If the tunnel is coming up initially then p1 & p2 probably matches up but its an issue during rekey.

Either disable PFS both sides or enable on both sides.

Also paste the sanitized cisco config as well as debug if you can.

L4 Transporter

Re: Tunnel times

Here are the ipsec settings

ipsec crypto settings on PA

encryption - aes256
authentication - sha1
DH group - group1
lifetime 8 hours
lifesize - not set

Cisco 5505 ipsec crypto settings

encryption -AES256
Authentication - sha
DH - group1
SA lifetime settings - 8 hours
Traffic voluem - 4608000 KB

I attempted to change the PA to 4608000 KB but it would not take the setting. I set it to 4800 MB and it brought down the tunnel and I could not bring it back up. I have other tunnels to the same cisco that are working fine and the are set very simliarly

L3 Networker

Re: Tunnel times

Can you configure another ipsec profile on the cisco side without the lifesize/traffic volume ? is the lifesize a mandatory security setting ?

How are the PFS set on the cisco ? can you try to disable on both ?

L4 Transporter

Re: Tunnel times

Okay so PFS and diffhelman are basically the same thing. So based on that it is enabled on the PA and on the Cisco

L7 Applicator

Re: Tunnel times

PFS is a property of key-agreement protocols, ensuring that a session key derived from phase-2 will use for actual data transmission. PFS uses DH algorithm.

Thanks

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!