About AMS-IX

Hi @MPI-AE,   We got the following command from PAN TAC, please use at own risk though: debug management-server client disable cord ... View more

Apologies for posting through space in time, but someone might have gotten a clue in the mean time, before we opened a case with our partner. We encountered the same error in our 8.1.2 running Panorama KVM VM (legacy mode). I'm not sure if it's correlated somehow, but the problem appeared after we mounted a large NFS volume for log storage. Before that commits were working without any issues.    Adding insult to injury, generating a tech support file seems to get stuck at 10%, regardless of whether it's generated via the GUI or the CLI. Any pointers or ideas would be greatly appreciated!   UPDATE: We confirmed it's the NFS store, and probably its large size (8TB). When we added a temporary ACL entry in an intermediate router to block access to the NFS store from Panorama, and after rebooting Panorama, commits were working fine again. HTH someone!  ... View more

Hello @ArnljotSeem, Unfortunately this thread is now 2 years old, so I cannot recall what the root cause was. Based on your problem description so far though, I'm inclined to say that the issue behind it is not the same one. You're saying that other VPN s2s solutions work, and this is specific to the PA and StrongSwan. I'd check release notes for any later StrongSwan versions, and/or try a different FOSS IPSec solutions, if at all possible. This message sounds hopelessly generic, but I'd at least wanted to let you know I didn't have the answer you were seeking for anyway 😕 ... View more

Thanks for your reply, Pankaj. I already in fact did that: I can see the ICMP echo request in the cluster, but no ICMP echo replies are ever seen.. I have already opened a support request with our integrator. I was hoping this whole thing to be a misconfiguration of some sort, but chances of that are getting slimmer.. ... View more

Hi Pankaj, Here's the output: aris@panix2(active)> show session all filter application ping source a.b.c.11 -------------------------------------------------------------------------------- ID          Application    State   Type Flag  Src[Sport]/Zone/Proto (translated IP[Port]) Vsys                                          Dst[Dport]/Zone (translated IP[Port]) -------------------------------------------------------------------------------- 333341       ping           ACTIVE  FLOW  NS   a.b.c.11[59216]/int-servers/1  (10.20.30.11[59216]) vsys1                                          172.26.16.6[328]/vpn  (172.26.16.6[328]) aris@panix2(active)> show session id 333341 Session          333341         c2s flow:                 source:      a.b.c.11 [int-servers]                 dst:         172.26.16.6                 proto:       1                 sport:       59216           dport:      39                 state:       INIT            type:       FLOW                 src user:    unknown                 dst user:    unknown         s2c flow:                 source:      172.26.16.6 [vpn]                 dst:         10.20.30.11                 proto:       1                 sport:       39              dport:      59216                 state:       INIT            type:       FLOW                 src user:    unknown                 dst user:    unknown         start time                           : Mon Aug 10 08:41:47 2015         timeout                              : 6 sec         total byte count(c2s)                : 102         total byte count(s2c)                : 0         layer7 packet count(c2s)             : 1         layer7 packet count(s2c)             : 0         vsys                                 : vsys1         application                          : ping          rule                                 : IS-V-001         session to be logged at end          : True         session in session ager              : False         session updated by HA peer           : False         address/port translation             : source         nat-rule                             : Internal Servers(vsys1)         layer7 processing                    : enabled         URL filtering enabled                : False         session via syn-cookies              : False         session terminated on host           : False         session traverses tunnel             : True         captive portal session               : False         ingress interface                    : ae2.105         egress interface                     : tunnel.2         session QoS rule                     : N/A (class 4)         tracker stage firewall               : Aged out         end-reason                           : aged-out ... View more