Request help with the exact meaning of these IPsec event alerts for Palo Alto.

[Kandarp_Desai]

Hello All, 

I would like to know what is the meaning of the typical events we observe in the IPsec details in the monitor logs. 

ikev2-nego-ike-succ

ikev2-nego-child-succ

ipsec-key-install

ikev2-nego-child-start

ikev2-nego-ike-dpd-dn

ipsec-key-delete

ikev2-nego-stale-p2

ikev2-nego-ike-succ

ipsec-key-expire

[TomYoung · Accepted solution]

Hi @Kandarp_Desai ,

Most of those log messages are located here -> https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syst....

Here is a quick and dirty explanation of each:

SA = security association = separate encrypted tunnel

ikev2-nego-ike-succ = IKEv2 Phase 1 successfully negotiated

ikev2-nego-child-succ = IKEv2 Phase 2 successfully negotiated (Child SAs are typically negotiated for each subnet pair)

ipsec-key-install = encryption keys are renewed at regular intervals

ikev2-nego-child-start = a new child SA was created

ikev2-nego-ike-dpd-dn = Dead Peer Detection is down, maybe look at the timers

ipsec-key-delete = encryption keys are renewed at regular intervals

ikev2-nego-stale-p2 = Deleting a possible stale IKEv2 child SA.

ipsec-key-expire = encryption keys are renewed at regular intervals

SAs are created and deleted as needed by traffic.  These logs are all normal with the exception of DPD down.  However, since the severity is low, the tunnel probably stayed up.  Here is an article on DPD and tunnel monitoring (2 separate technologies) -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFaCAK.

Thanks,

Tom

[Kandarp_Desai]

Thanks for your help Tom !!