Tunnel times

[infotech]

I have a tunnel that is up 8 hours and down 16 hours almost consistently any one have any ideas what would cause that?

[jkim2]

Be deafult Perfect Forward Secrecy (PFS) is enabled on the Palo.

If the tunnel is coming up initially then p1 & p2 probably matches up but its an issue during rekey.

Either disable PFS both sides or enable on both sides.

Also paste the sanitized cisco config as well as debug if you can.

[infotech]

Here are the ipsec settings

ipsec crypto settings on PA

encryption - aes256
authentication - sha1
DH group - group1
lifetime 8 hours
lifesize - not set

Cisco 5505 ipsec crypto settings

encryption -AES256
Authentication - sha
DH - group1
SA lifetime settings - 8 hours
Traffic voluem - 4608000 KB

I attempted to change the PA to 4608000 KB but it would not take the setting. I set it to 4800 MB and it brought down the tunnel and I could not bring it back up. I have other tunnels to the same cisco that are working fine and the are set very simliarly

[jkim2]

Can you configure another ipsec profile on the cisco side without the lifesize/traffic volume ? is the lifesize a mandatory security setting ?

How are the PFS set on the cisco ? can you try to disable on both ?

[infotech]

Okay so PFS and diffhelman are basically the same thing. So based on that it is enabled on the PA and on the Cisco

[HULK]

PFS is a property of key-agreement protocols, ensuring that a session key derived from phase-2 will use for actual data transmission. PFS uses DH algorithm.

Thanks

[infotech]

so can you enable PFS on the PA?

[HULK]

Hello Infotech,

Yes, you can enable PFS on PAN firewall. It's a phase-2 property. Need to make sure both sides should have the same settings.

Thanks

[infotech]

Okay then I am correct it is already enabled and has always been enabled. DH group and PFS are basically the same thing