Unstable ipsec detection for ipsec-esp-udp application when connecting Globalprotect VPN

[Trond.Olsen]

We have a setup with a primary PA firewall 1 that pass through Globalprotect VPN traffic to a second PA firewall 2. We've seen sporadic connection problems when connecting a Globalprotect client. Sometimes it can spend up to 2 minutes to establish the VPN. When these connection problems occur firewall 1 will log unknown-udp on port 4501. Besides allowing any application with service ports in the Globalprotect policy, is it possible to improve reliability when using ipsec application?

[TranceforLife]

Hi,

Any particular clients facing this issue? 

[Trond.Olsen]

This is on Windows 64-bit using the latest client software.

[TranceforLife]

Hi,

It is hard to conclude based on this info. In your GP policy, do you have services as "any" or "application-default"? Do you have an ability to raise the TAC case providing them with the PCAP from the firewall when the issue is visible?

[BPry]

@Trond.Olsen,

This should be a fairly stable signature; I would raise a case with TAC and see if they could work with you on it. 

[Trond.Olsen]

@TranceforLife
Policy was initially configured with default-application. We've experienced better reliabilty using service ports instead. Still get sporadic VPN connections thats logged as unknown-udp on port 4501 though but it working.

Also forgot to mention that there is a destination NAT policy involved.

@BPry
Its a bit hard to do packet capture since vpn connections generate so much data. We've got no reliable way to reproduce unknown-udp application detection. But I'll keep it in mind in case we have do to some further digging.

[TranceforLife]

Hi,

l don't think DNAT should or causing issues. If application is identified incorrectly (unknown-udp it is also app within the database) then TAC case is the next destination 😄 Please post the outcome 

[Trond.Olsen]

An update: This was a hard to replicate APP-ID misidentification but got fixed in content update 752-4343.