ipsec-esp / Protocol 50 invisible in vwire mode ?

Reply
L1 Bithead

ipsec-esp / Protocol 50 invisible in vwire mode ?

We have a Vwire configuration with a paloalto (5.0.6) between a third-party router and the wan port.

Security policy is allow any - any for both directions/security zones, log at session start an end.

Everything works (as expected), all VPN Tunnels on the third party device are up and running, but we dont see any ipsec-esp traffic in the traffic monitor, or ACC stats.

If we make a packet capture on the paloalto we do see that the ipsec-esp packets are passing through the vwire.

We already tried du define two additional rules with ipsec as application - but that does not change anything.

Any hints ?

L5 Sessionator

Re: ipsec-esp / Protocol 50 invisible in vwire mode ?

Hello,

Are we able to see live sessions on the the paloalto for protocol 50?

The command to check that would be:

> show session all filter protocol 50

Regards,

Kunal Adak

L1 Bithead

Re: ipsec-esp / Protocol 50 invisible in vwire mode ?

yes, we do see them.

L5 Sessionator

Re: ipsec-esp / Protocol 50 invisible in vwire mode ?

Can you paste the o/p of the following commands:-

debug log-receiver statistics

show system logdb-quota

show system disk-space

L5 Sessionator

Re: ipsec-esp / Protocol 50 invisible in vwire mode ?

It is possible that the traffic for the ipsec-udp is minimal and the criteria you have set it does not show in that.

Also keep in mind the data is logged at the session end.

Verify that the setting are expanded as per need for Time, sort by and top

Capture.JPG.jpg

Also anther thing you can do is check in the traffic logs to verify if you have logs for it by using the filter.

You can use following filter ( app eq ipsec-esp-udp ) and ( app eq ipsec-esp )

If nothing shows up here then do it based on the traffic rule e.g ( rule eq rule_name )

If the traffic shows up now. Then verify what is the application it is showing. If it is showing up undecided or the actual applicaiton name.

If it is showing up as actual application name then as mentioned above it is just possible that you have minimal traffic for it and it is just now showing up in ACC tab.

Hope this helps.
Thanks

Numan

L4 Transporter

Re: ipsec-esp / Protocol 50 invisible in vwire mode ?

Perhaps enable logging on session start to check if you see the logs then? When logging on session end, you will only see the log when the session end, so if there are keep alive packets send through the tunnel, you won't see a log.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!