I have a question about capture conditions, etc. when using packet dump in IPSec VPN.

[Y.Choi436432]

Hi

I am experiencing latency between Palo Alto of internal server and peer of internal server in IPSec and am trying to perform packet dump on Palo Alto firewall.

And I performed packet dump with the following conditions

However, Syn and Ack packets are not recognized by the firewall

However, Syn-ack is confirmed

(It is thought that this phenomenon is caused by filter conditions, and it is assumed that this is because IPsec communication encrypts the internal server IP.)

To help you understand, I will upload photos and filter conditions.

1. filter

 1-1) Ingress Interface (none)

 1-2) source (10.1.1.100) (Palo Alto of internal Server)

 1-3) destination (0.0.0.0 or 172.16.1.100)

 2-1) Ingress Interface (none)

 2-2) source (172.16.1.100) (Peer of internal Server)

 3-3) destination (0.0.0.0 or 10.1.1.100)

2. stage

 1) rx

 2) tx

 3) firewall

Please tell me why I can't get packet information from the firewall properly and how to get it properly.

[TomYoung]

Hi @Y.Choi436432 ,

I have done many packet captures on the NGFW, and I have captured plenty of TCP SYN, ACK, and SYN/ACK packets.  For starters, I always specify the ingress interfaces.  You would list your internal Ethernet interface and the VPN tunnel interface.

I also add the drop stage.  You want to know if the NGFW is dropping packets.  You can use a CLI command to determine the reason for the drops.  For example, you may have a Zone Protection Profile that drops SYN packets with data.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloNCAS

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTJCA0&lang=en_US

Good luck!

Tom