ipsec-esp / Protocol 50 invisible in vwire mode ?

[register]

We have a Vwire configuration with a paloalto (5.0.6) between a third-party router and the wan port.

Security policy is allow any - any for both directions/security zones, log at session start an end.

Everything works (as expected), all VPN Tunnels on the third party device are up and running, but we dont see any ipsec-esp traffic in the traffic monitor, or ACC stats.

If we make a packet capture on the paloalto we do see that the ipsec-esp packets are passing through the vwire.

We already tried du define two additional rules with ipsec as application - but that does not change anything.

Any hints ?

[kadak]

Hello,

Are we able to see live sessions on the the paloalto for protocol 50?

The command to check that would be:

> show session all filter protocol 50

Regards,

Kunal Adak

[register]

yes, we do see them.

[sraghunandan]

Can you paste the o/p of the following commands:-

debug log-receiver statistics

show system logdb-quota

show system disk-space

[mbutt]

It is possible that the traffic for the ipsec-udp is minimal and the criteria you have set it does not show in that.

Also keep in mind the data is logged at the session end.

Verify that the setting are expanded as per need for Time, sort by and top

Also anther thing you can do is check in the traffic logs to verify if you have logs for it by using the filter.

You can use following filter ( app eq ipsec-esp-udp ) and ( app eq ipsec-esp )

If nothing shows up here then do it based on the traffic rule e.g ( rule eq rule_name )

If the traffic shows up now. Then verify what is the application it is showing. If it is showing up undecided or the actual applicaiton name.

If it is showing up as actual application name then as mentioned above it is just possible that you have minimal traffic for it and it is just now showing up in ACC tab.

Hope this helps.
Thanks

Numan

[bdeschut]

Perhaps enable logging on session start to check if you see the logs then? When logging on session end, you will only see the log when the session end, so if there are keep alive packets send through the tunnel, you won't see a log.