how to View Pre-Shared key in PA

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

how to View Pre-Shared key in PA

L0 Member

i'm have issues with IPSEC Tunnel which is configured by another engineer. currently facing issues with Tunnel connectivity and i need to cross verify the parameters. So can someone guide how to heck pre shared key in plain text format 

@IPSec IPSec S2S VPN between Palo Alto and 3rd party Security FW Vendor -> ISAKMP Negotiation Question regarding site to site VPN 

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

@iamvivekms,

This isn't possible. You can't go back and get the clear text value for anything in the configuration when it comes to passwords, pre-shared keys or anything of the sort. The firewall simply stores hash or encrypted form of the value.

View solution in original post

6 REPLIES 6

Cyber Elite
Cyber Elite

@iamvivekms,

This isn't possible. You can't go back and get the clear text value for anything in the configuration when it comes to passwords, pre-shared keys or anything of the sort. The firewall simply stores hash or encrypted form of the value.

L4 Transporter

as @BPry said, but to verifiy if there is a mismatch you can use this command in CLI:

less mp-log ikemgr.log

 

@Abdul-Fattah , you will see "pre-share mismatch" only if the remote site is initiator of the tunnel negotiation and you are receiver. If you are the initiator you will only see "IKE phase1 timeout" message in the logs. This is caused by the nature of the IPsec 

Cyber Elite
Cyber Elite

@iamvivekms 

 

If you see in logs as @aleksandar.astardzhiev  mentioned then best thing is to have new key on both ends.

Unless you can get the Pre-Shared key from other side of the connection.

 

Regards

MP

Help the community: Like helpful comments and mark solutions.

L0 Member

Thanks guys for your response...what i understand is that we have very limited options in Paloalto in terms of troubleshooting Tunnel down issues.. So i can go ahead and reconfigure Pre-shared key and test again.

 

Appreciated Everyone for your response !! @BPry @Abdul-Fattah @MP18 

 

 

 

 

 

Hey @iamvivekms ,

 

I cannot agree with your statement  - "we have very limited options in Paloalto in terms of troubleshooting Tunnel down issues"

It is quite the opposite:

  1. 1. Palo Alto is not the only vendor that does not store pre-shared key in plain text. It is actually way better to do it this way rather have it in plain text just because you lack proper documentation. Having the psk in plain-text for troubleshooting is like having your password written on sticky note on your monitor in case you forgot it... 
  2. Palo Alto firewall provides you several ways to troubleshoot IPsec tunnel. PAN is actually my favorite vendor for IPsec troubleshooting as it has excellent document and easy to use tools/commands.
    1. You can check here for commands that you can use for debug/troubleshooting - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC
    2. If you have multiple tunnels configured on your firewall it is recommended to enable tunnel debug only for specific peer - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcKCAS
    3. You could also be useful for you - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PORsCAO
  3. You need to remember that the receiver of the tunnel negotiation will log the actual reason for negotiation failure. So if you want to troubleshoot the tunnel at your end (on the Palo) you can "enable passive mode" under the IKE Gateway -> Advance options. This will force your firewall to only act as receiver and never as initiator for this peer. I believe Palo Alto TAC recommend this option only during t-shoot as it will cause traffic drop if your fw receive traffic that needs to be sent over the tunnel, but it is not established yet.

 

Wrong PSK is the most common mistake when configuring new tunnel so my suggest in this case is:

1. Re-Enter the psk again at your end of the tunnel. 

2. Re-enter the psk at remote end of the tunnel

3. Agree on new psk

  • 1 accepted solution
  • 17921 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!