We are not able to connect VPN hosted in vpn_dmz zone.
We have deployed third party vpn in vpn_dmz zone and configured inbound nat for same.
Its old setup , all of sudden we are unable to connect vpn intermittently.
did pcap for vpn public ip , showing below counter after running "show counter global filter packet-filter yes delta yes severity drop" command
tcp client reset via TCP responding rst:
I would interpret this to mean that the Srv side of the VPN reset the connection,and likewise, the client side reset its side of the TCP connection. But I think you are getting perhaps a little too deep in analysis.
What is the current status of your VPN? It is up or not?
If it is not up, run a "clear vpn flow", followed by "test vpn ike-sa", then "test vpn ipsec-sa", and then look at your System Logs for the output on the responses to these commands. One side needs to initiate the vpn, and the other side needs to respond. What do you see in your logs.
Presuming that ipsec and ike are allowed by a security policy, you should get some response/details about what is going on.
Can you get the remote (non PAN) to initiate the VPN and you again at logs on your PANW FW.
I do not personally think it is necessary to look at global counters. If packets are going to be dropped,you would see the session in the Session Browser or the Traffic Logs.
Again, we are getting closer. 😛
Instead of looking at traffic logs, let's see why your VPN is not being established.
Could you copy/paste the logs from your System logs, with a "subtype eq vpn"
We would normally expect Phase1 (ike) and phase2 (IPsec) to be negotiated and those negotiations logs are found in System.
tcp-fin means that the session closed by a FIN packet. Unless you can provide visual information, it may be hard to explain what/why/how this is not working as expected.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!