Request help with the exact meaning of these IPsec event alerts for Palo Alto.

[Kandarp_Desai]

Hello All, 

I would like to know what is the meaning of the typical events we observe in the IPsec details in the monitor logs. 

ikev2-nego-ike-succ

ikev2-nego-child-succ

ipsec-key-install

ikev2-nego-child-start

ikev2-nego-ike-dpd-dn

ipsec-key-delete

ikev2-nego-stale-p2

ikev2-nego-ike-succ

ipsec-key-expire

[TomYoung · Accepted solution]

Hi @Kandarp_Desai ,

Most of those log messages are located here -> https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syst....

Here is a quick and dirty explanation of each:

SA = security association = separate encrypted tunnel

ikev2-nego-ike-succ = IKEv2 Phase 1 successfully negotiated

ikev2-nego-child-succ = IKEv2 Phase 2 successfully negotiated (Child SAs are typically negotiated for each subnet pair)

ipsec-key-install = encryption keys are renewed at regular intervals

ikev2-nego-child-start = a new child SA was created

ikev2-nego-ike-dpd-dn = Dead Peer Detection is down, maybe look at the timers

ipsec-key-delete = encryption keys are renewed at regular intervals

ikev2-nego-stale-p2 = Deleting a possible stale IKEv2 child SA.

ipsec-key-expire = encryption keys are renewed at regular intervals

SAs are created and deleted as needed by traffic.  These logs are all normal with the exception of DPD down.  However, since the severity is low, the tunnel probably stayed up.  Here is an article on DPD and tunnel monitoring (2 separate technologies) -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFaCAK.

Thanks,

Tom

[Kandarp_Desai]

Thanks for your help Tom !!

[MostafaSafari]

@TomYoung 

Hello Tom,

I have a question some how related to this post.

I am seeing a lot of events with severity of informational like the below events over and over, multiple of these events in a second.

is it normal?
ikev2-nego-child-succ
ipsec-key-install
ikev2-nego-child-start
ikev2-recv-p2-delete
ipsec-key-delete
ikev2-send-p2-delete
ikev2-nego-ike-succ
ikev2-nego-child-succ
ipsec-key-install
ikev2-nego-child-start
ikev2-nego-ike-start