how to View Pre-Shared key in PA

[iamvivekms]

i'm have issues with IPSEC Tunnel which is configured by another engineer. currently facing issues with Tunnel connectivity and i need to cross verify the parameters. So can someone guide how to heck pre shared key in plain text format 

@IPSec IPSec S2S VPN between Palo Alto and 3rd party Security FW Vendor -> ISAKMP Negotiation Question regarding site to site VPN 

[BPry · Accepted solution]

@iamvivekms,

This isn't possible. You can't go back and get the clear text value for anything in the configuration when it comes to passwords, pre-shared keys or anything of the sort. The firewall simply stores hash or encrypted form of the value.

[Abdul-Fattah]

as @BPry said, but to verifiy if there is a mismatch you can use this command in CLI:

less mp-log ikemgr.log

[Astardzhiev]

@Abdul-Fattah , you will see "pre-share mismatch" only if the remote site is initiator of the tunnel negotiation and you are receiver. If you are the initiator you will only see "IKE phase1 timeout" message in the logs. This is caused by the nature of the IPsec 

[MP18]

@iamvivekms 

If you see in logs as @Astardzhiev  mentioned then best thing is to have new key on both ends.

Unless you can get the Pre-Shared key from other side of the connection.

Regards

[iamvivekms]

Thanks guys for your response...what i understand is that we have very limited options in Paloalto in terms of troubleshooting Tunnel down issues.. So i can go ahead and reconfigure Pre-shared key and test again.

Appreciated Everyone for your response !! @BPry @Abdul-Fattah @MP18 

[Astardzhiev]

Hey @iamvivekms ,

I cannot agree with your statement  - "we have very limited options in Paloalto in terms of troubleshooting Tunnel down issues"

It is quite the opposite:

1. 1. Palo Alto is not the only vendor that does not store pre-shared key in plain text. It is actually way better to do it this way rather have it in plain text just because you lack proper documentation. Having the psk in plain-text for troubleshooting is like having your password written on sticky note on your monitor in case you forgot it... 
2. Palo Alto firewall provides you several ways to troubleshoot IPsec tunnel. PAN is actually my favorite vendor for IPsec troubleshooting as it has excellent document and easy to use tools/commands.
   1. You can check here for commands that you can use for debug/troubleshooting - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC
   2. If you have multiple tunnels configured on your firewall it is recommended to enable tunnel debug only for specific peer - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcKCAS
   3. You could also be useful for you - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PORsCAO
3. You need to remember that the receiver of the tunnel negotiation will log the actual reason for negotiation failure. So if you want to troubleshoot the tunnel at your end (on the Palo) you can "enable passive mode" under the IKE Gateway -> Advance options. This will force your firewall to only act as receiver and never as initiator for this peer. I believe Palo Alto TAC recommend this option only during t-shoot as it will cause traffic drop if your fw receive traffic that needs to be sent over the tunnel, but it is not established yet.

Wrong PSK is the most common mistake when configuring new tunnel so my suggest in this case is:

1. Re-Enter the psk again at your end of the tunnel. 

2. Re-enter the psk at remote end of the tunnel

3. Agree on new psk