Ipsec VPN traffic issue

[Satish]

   why we are getting CISCOVPN traffic flow on VPN. please suggest.

[ajbool]

Is the far end of the VPN a Cisco device?

Ciscos do advertise their vendor in the IKE exchange, you can se this in the 'less mp-log ikemgr.log' output:

2014-09-04 03:16:56 [INFO]: received Vendor ID: CISCO-UNITY

I think is is due to this that ciscovpn is selected as the application within the Palo Alto firewall.

[Satish]

Hi Ajbool, Yes, End side is the cisco device and i have more then 100 tunnels but most of cisco but i am facing this issue is only 3-4 tunnel.i have all ready create a application overwrite policy but till, i am facing this issue. Thanks Regards Satish

[hshah]

Hi Satish,

Please find analysis of application "ciscovpn"

The Cisco VPN Client allows organizations to establish end-to-end, encrypted VPN tunnels for secure connectivity for mobile employees or teleworkers.

Based on above analysis, there is a ciscovpn client which has generated remote access VPN request.

Can you confirm the same, via tracing source and destination.

Regards,

Hardik Shah

[HULK]

Hello Satish,

If the IKE traffic is terminated on a Cisco device, it can contain a Cisco vendor ID field.  If Cisco vendor ID field is seen in IKE packets by the AppID it will be identified as 'ciscovpn' application.

Reference DOC:

ciscovpn

Hope this helps.

Thanks

[Satish]

HI Hulk Dud., You are right but question is that there are also other Cisco Tunnel but application identify as IPsec but few tunnel is identify as a CiscoVPN why??? Regards Satish

[HULK]

Hello Satish,

In both cases, could you please apply >show session id xxxx and share the output.

Thanks