PANOS 10.2.8 NOT recommended: S2S VPN IKEv1, IKEv2 Prefered does not work anymore

[FabioHufschmid]

Hi Everybody,

We updated from 10.2.7 to 10.2.8 and had a lot of troubles with our Site-2-Site IKEv1, IKEv2 Prefered gateway connections. I'm not sure if the IKE Version is the root problem, but that was the pattern that was visible in the short time for this change.

Phase 1 came not up, initiated in both directions.

There are the msg in the logs:

Us-2-endpoint: 'IKE phase-1 negotiation is failed as responder, main mode. Failed SA:

Endpoint-2-us: the logs said always "Connection Timeout".

Sophos, FritzBox and Azure were the other endpoints, we were not able to etablish phase 1. After Downgrading to 10.2.7 everything worked, also with 10.2.7-h3 is everything working.

We did not seen in the traffic monitor any traffic for the phase1, although we otherwise saw this connection traffic in an intrazone (Untrust-2-Untrust) rule. With PANOS 10.2.7 and H3 it was visible again

Also without Zone Protection, the connection came not up, it was like something was blocking the connection, without generating logs.

I didn't find something in the release notes that point to this issue. Somebody else with this experience?

Happy firewalling

[MILAVITSA]

There are two NAT rules (destination-translation) for the Exchange2019 mail server, starting from version 1.2.8 they stopped working. They work for some time, then they are blocked, there is no information in the logs.

In version 1.2.9 the same thing.

[JayGolf]

Thanks for providing valuable insight @FabioHufschmid ! If you ever have the time, please open up a support ticket and share details of your findings.