- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
09-05-2014 04:40 AM
09-05-2014 04:55 AM
Is the far end of the VPN a Cisco device?
Ciscos do advertise their vendor in the IKE exchange, you can se this in the 'less mp-log ikemgr.log' output:
2014-09-04 03:16:56 [INFO]: received Vendor ID: CISCO-UNITY
I think is is due to this that ciscovpn is selected as the application within the Palo Alto firewall.
09-05-2014 05:14 AM
Hi Ajbool, Yes, End side is the cisco device and i have more then 100 tunnels but most of cisco but i am facing this issue is only 3-4 tunnel.i have all ready create a application overwrite policy but till, i am facing this issue. Thanks Regards Satish
09-05-2014 06:56 AM
Hi Satish,
Please find analysis of application "ciscovpn"
The Cisco VPN Client allows organizations to establish end-to-end, encrypted VPN tunnels for secure connectivity for mobile employees or teleworkers.
Based on above analysis, there is a ciscovpn client which has generated remote access VPN request.
Can you confirm the same, via tracing source and destination.
Regards,
Hardik Shah
09-05-2014 07:48 AM
Hello Satish,
If the IKE traffic is terminated on a Cisco device, it can contain a Cisco vendor ID field. If Cisco vendor ID field is seen in IKE packets by the AppID it will be identified as 'ciscovpn' application.
Reference DOC:
Hope this helps.
Thanks
09-05-2014 08:50 AM
HI Hulk Dud., You are right but question is that there are also other Cisco Tunnel but application identify as IPsec but few tunnel is identify as a CiscoVPN why??? Regards Satish
09-05-2014 09:10 AM
Hello Satish,
In both cases, could you please apply >show session id xxxx and share the output.
Thanks
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!