Ipsec VPN traffic issue

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Ipsec VPN traffic issue

L4 Transporter

   why we are getting CISCOVPN traffic flow on VPN. please suggest.

sa.png

6 REPLIES 6

L3 Networker

Is the far end of the VPN a Cisco device?

Ciscos do advertise their vendor in the IKE exchange, you can se this in the 'less mp-log ikemgr.log' output:

2014-09-04 03:16:56 [INFO]: received Vendor ID: CISCO-UNITY

I think is is due to this that ciscovpn is selected as the application within the Palo Alto firewall.

Hi Ajbool, Yes, End side is the cisco device and i have more then 100 tunnels but most of cisco but i am facing this issue is only 3-4 tunnel.i have all ready create a application overwrite policy but till, i am facing this issue. Thanks Regards Satish

Hi Satish,

Please find analysis of application "ciscovpn"

The Cisco VPN Client allows organizations to establish end-to-end, encrypted VPN tunnels for secure connectivity for mobile employees or teleworkers.

Based on above analysis, there is a ciscovpn client which has generated remote access VPN request.

Can you confirm the same, via tracing source and destination.

Regards,

Hardik Shah

L7 Applicator

Hello Satish,

If the IKE traffic is terminated on a Cisco device, it can contain a Cisco vendor ID field.  If Cisco vendor ID field is seen in IKE packets by the AppID it will be identified as 'ciscovpn' application.

Reference DOC:

ciscovpn

Hope this helps.

Thanks

HI Hulk Dud., You are right but question is that there are also other Cisco Tunnel but application identify as IPsec but few tunnel is identify as a CiscoVPN why??? Regards Satish

Hello Satish,

In both cases, could you please apply >show session id xxxx and share the output.

Thanks

  • 3203 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!