03-06-2023 04:13 PM
Hi @Kandarp_Desai ,
Most of those log messages are located here -> https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syst....
Here is a quick and dirty explanation of each:
SA = security association = separate encrypted tunnel
ikev2-nego-ike-succ = IKEv2 Phase 1 successfully negotiated
ikev2-nego-child-succ = IKEv2 Phase 2 successfully negotiated (Child SAs are typically negotiated for each subnet pair)
ipsec-key-install = encryption keys are renewed at regular intervals
ikev2-nego-child-start = a new child SA was created
ikev2-nego-ike-dpd-dn = Dead Peer Detection is down, maybe look at the timers
ipsec-key-delete = encryption keys are renewed at regular intervals
ikev2-nego-stale-p2 = Deleting a possible stale IKEv2 child SA.
ipsec-key-expire = encryption keys are renewed at regular intervals
SAs are created and deleted as needed by traffic. These logs are all normal with the exception of DPD down. However, since the severity is low, the tunnel probably stayed up. Here is an article on DPD and tunnel monitoring (2 separate technologies) -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFaCAK.
Thanks,
Tom
