About Sujanya

Hi @Raido_Rattameister ,   Thanks for the details. It was helpful. We are planning to upgrade our GP client to 6.2 version as the base , So is there any Palo-Alto site to check on the current preferred client version. The below URL seems having useful information , but it was updated 2 months before. https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304   ... View more

@BPry ,   Thank you so much. I got it. ... View more

@BPry ,   Thanks for the response. No we are using static routes only. and we are using layer3 as interface. Don't we have interface monitoring functionality in Palo-Alto. ... View more

Hi @Raido_Rattameister ,   The issue was fixed when we set the DHGroup value as 14 in the other end as well. One Thing to notice and need clarity is, Will Palo-Alto with 440 model and PAN-OS version 10.1.6-h6 will not supports DHGroup 16 ??? I was able to see only 1,2,5,14, 19 and 20  ... View more

Hi @Raido_Rattameister ,   Also we noticed that even though we are pushing the DHgroup value as 16 from Panorama , Palo-alto firewall taking the configuration at its end as DH14. and as per the communication with Cisco router end we asked them to keep the tunnel parameters as 16. Do you feel will it case any issue. ... View more

Hi @Raido_Rattameister , Peer end engineer team confirmed that phase-2 lifespan is set for 1 hour only.    Also they have observed one more thing whenever the tunnel goes down, we are using test commands ( both for gateway and ipsec tunnel) to manually bring up the tunnel. We are seeing our phase-1 IKE-SA is being refreshed with newer-spi, but at the peer end which is cisco router 1000 there were multiple SA being generated( older SA is not terminating until they clear it manually) ... View more

Actually there is no tunnel-monitor or Keepalive configured at both the end. We have kept the continues ping as well from the backend server to the other end IP address to keep the tunnel active. But exactly after 1 hour ( lifespan set for IPSEC phase 2 ) tunnel went down and we started getting timeout for tunnel. After I using the below two commands , tunnel came up again and ping started working fine. test vpn ike-sa gateway <gateway_name> show vpn ike-sa gateway <gateway_name>   test vpn ipsec-sa tunnel <tunnel_name> show vpn ipsec-sa tunnel <tunnel_name> ... View more

Hi @Raido_Rattameister ,   Yes we can see via GUI that IPSEC tunnel info is showing red but the IKE Info is showing always green. In this situation if any traffic has been initiated by backend server communication is allowed with no return traffic.  There is no keepalive and tunnel monitor is enabled at both the ends. The interested traffic is the telnet traffic which will be randomly initiated by user. ... View more

Hi @OtakarKlier ,   Thanks for your response. We also noticing that there is no ike-phase-1 delete message being send from Palo-Alto to peer end device. Whenever we were seeing 1 IKE SA has been created at Palo-Alto , there would be multiple IKE-SA is visible at the peer Cisco router end.     ... View more

Hi @OtakarKlier ,   Thanks for responding. We are not able to ping the customer gateway and as well as network as ping is not allowed from them. Will the keepalive still works in that situation. ... View more