Problem Creating Rule for IKE Traffic

[rmagowan]

I think it's my phase II re-key traffic being dropped. I tried to set up a rule source untrust with a specific IP, dest untrust with my Firewall's IP, application IPSEC, service application default, Action Allow.

It never gets hit and my udp/500 traffic gets dropped by my clean-up rule.

I am brand new to Palo Alto and probably don't fully understand apps and services yet. If I turn off the drop rule, everything is fine but that seems to defeat the purpose of the firewall no?

Thanks 

[bpappas · Accepted solution]

add IKE to your applications on the VPN rule.

the any/any cleanup rule is blocking intrazone traffic.

-Benjamin

[rmagowan]

I've a much deeper understanding about the implicit drop rule. I was stiil in CP frame of mind. Folks wanted to see the dropped traffic, hence the rule with screwed up all my intrzone traffic and pushed my down the path of IKE policy things. I've taken out the drop rule (clean-up Rule), explained the situation to my co-workers and developed a pair of rules that will give drop info if needed later on. My PA5020 HA cluster thanks you, I thank you.