IPSEC site-to-site; passing ICMP only.. no other protocol (TCP/UDP)

[mpgioia]

I have an IPSEC-to-SITE.

IKE Phase 1 and Phase 2 are good/live.

Tunnel interface in right zone.  Routes fines.

Policy defined (app: any, service: any).

I can see the policy being hit when I generate icmp/pings.  And can get to the proxy id's/subnets on other side.

I can't get anything other than ICMP through though.. No other TCP/UDP layer traffic.. no logs generated from the same policy (which should be evoked because of the source/destination condition match's that work for ICMP) that should get hit... very strange... ?

[TranceforLife]

Can you please post the magnified traffic log output from the successful ping requests.

[mpgioia]

[TranceforLife]

How to you forward the traffic with a static route or PBF? Traceroute output

[mpgioia]

Static. default vr. to tunnel interface.

From the 192.168.75.15 host (near end) below.

[Remo]

So a little recap: you can ping the host on the other side but you are not able to transfer tcp traffic over the tunnel, right? And the paloalto firewall is on your own side where you start the ping/tcp sessions? And in addition you don't see any traffic logs for tcp traffic?

Did you try a flow basic to do a low level check whats happening on your side or if the traffic even arrives at your firewall?
https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-Flow-Basic/ta-p/72556

[mpgioia · Accepted solution]

... < embarassed > Intermediate firewall along the wire .. downstream .. before the PAN..

Tunnel and forwarding is fine.

But hey ! Great troubleshooting exercise we all went through.. 😕 Thanks everybody ❤️