Cisco AnyConnect over IKEv2 killed by PAN-OS 8.0

[GI-1]

Hi.

I've been running PAN-OS 8.0 since release, and immediately got problems with Cisco AnyConnect over IKEv2. Even if the session is very much alive, PAN-OS 8.0 kills it of after a random amount of time, usually a couple of hours.

If I change the AnyConnect policy to use SSL instead, everything runs fine.

PAN-OS 8.0 recognizes AnyConnect over IKEv2 as ipsec-esp-udp. Changing the default timeout to e.g. 86400 seconds changes nothing.

[reaper]

Hi

does the session indicate why it was terminated (idle, rst, ...) ?

[GI-1]

PAN-OS says "aged-out". Cisco AnyConnect doesn't even notice that it's been disconnected.

Everything worked fine in 7.1.7 and earlier.

Btw, it's a PA-200.

[BPry]

Do you see anything in the Threat logs; it kind of sounds like some security policy is preventing the traffic from passing, hence your age-out response. 

[GI-1]

Hi.

No, there's no entries in the threat log with the IP to the AnyConnect server.

[GI-1]

I see now that the apps and threats content release 658 did something to ipsec-esp-udp. I guess that's the culprit, and not necessarily 8.0.