Palo Alto troubleshooting tool for IPsec

[didier.bonato]

Hello

I established an Ipsec tunnel (policy based) between palo Alto and Cisco FW.

phase 1 & phase 2 are up and running but trying to transfer data, fail.

Capture packet (merge recieved and transmit) shown

Source : SYN

Dest : SYN ACK

And then Dest :  retransmit SYN ACK.

If this capture is within transmit pcap, this mean the re transmission packet have been forwarded  into the IPSEC Tunnel (egress interface) ?

Previoulsy, I was working with Checkpoint and able to use command line FW MONITOR to know if my packet was forward/encrypted to the tunnel. (this mean problem is located on FW itself or after the FW.

Is it a tool that permitting to know if this SYN ACK packet is forwarded into Interface tunnel or not ?

Regards

[OtakarKlier]

Hello,

Check the traffic logs to see why the traffic is getting blocked. Before this make sure you enable logging on your security policies. This should tell you where and why the traffic is getting blocked.

Security policy basics:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClWZCA0

Could also be routing, make sure you put the destination subnet into your virtual router and point the destination at the tunnel.

Hope this helps.

[didier.bonato]

Thanks for your reply,

Anyway, I don't have traffic blocked in logs (allowed but aged out), and the tcp handshake start with SYN and ACK, this mean not blocked.

I was suspecting routing issue, that's why (even the route is set as static route) I would like to know how to be sure, this ACK reply has been properly "pushed" to my tunnel interface?

Regards

[OtakarKlier]

Hello,

To check routing click the Networking tab at the top ->Virtual routers -> More Runtime Stats

Then look for a subnet that is on the Cisco side of the tunnel, then make sure it points to the tunnel. 

Regards,

[OtakarKlier]

Hello,

Also here are some additional articles that have additional information.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clh5CAC

Regards,

[KarD5d]

I had the same issue with failing Data transfer, however i found this discussion and thanks for your helpful articles links, I manage my issue, waiting more useful discussion about Ipsec tunnel.

[OtakarKlier]

Hello,

Glad you found it useful. Always feel free to post any questions.

Cheers!