VPN Site to site IPSec Tunnel not working

[smshafek]

Hello,

I've configured a VPN Tunnel from a PA220 to a PA200. They are able to ping each other but I don't see any ESP Packets in Wireshark. What should I do to get the packets to be encapsulated?

Many thanks in advanced.

[PavelK]

Thank you for the post @smshafek

if you see the ipsec tunnel up with packets being encapsulated/decapsulated and routing is set correctly to go through tunnel, there is no other extra step to do for traffic to be encapsulated. Could you please confirm how did you take packet capture? What interface did you use to capture traffic?

Kind Regards

Pavel

[smshafek]

Hi Pavel,

I'm capturing traffic on the two hosts. One connected to the LAN of PA220 and the other to the LAN of PA200.

Best regards

[PavelK · Accepted solution]

Thank you for reply @smshafek

The ipsec tunnel between two PA Firewalls does not provide host to host end to end encryption. You will only see ESP traffic on interfaces that are used to build ipsec tunnel. This is typically WAN interface of the Firewall. You can refer to this in ike gateway configuration.

If you want to do further verification of the tunnel configuration, I would recommend to take a look into this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTbCAK Please refer to the section: "Tunnel is up but the traffic is not passing". In the output from: "show vpn flow tunnel-id <tunnel id>" the inner interface is where naked traffic comes in and outer interface is where you will only see ESP traffic.

Kind Regards

Pavel

[smshafek]

Hi Pavel,

I'm able to capture the traffic now. Many thanks again!