About AMS-IX

Hi @MPI-AE,   We got the following command from PAN TAC, please use at own risk though: debug management-server client disable cord ... View more

Apologies for posting through space in time, but someone might have gotten a clue in the mean time, before we opened a case with our partner. We encountered the same error in our 8.1.2 running Panorama KVM VM (legacy mode). I'm not sure if it's correlated somehow, but the problem appeared after we mounted a large NFS volume for log storage. Before that commits were working without any issues.    Adding insult to injury, generating a tech support file seems to get stuck at 10%, regardless of whether it's generated via the GUI or the CLI. Any pointers or ideas would be greatly appreciated!   UPDATE: We confirmed it's the NFS store, and probably its large size (8TB). When we added a temporary ACL entry in an intermediate router to block access to the NFS store from Panorama, and after rebooting Panorama, commits were working fine again. HTH someone!  ... View more

Hello @ArnljotSeem, Unfortunately this thread is now 2 years old, so I cannot recall what the root cause was. Based on your problem description so far though, I'm inclined to say that the issue behind it is not the same one. You're saying that other VPN s2s solutions work, and this is specific to the PA and StrongSwan. I'd check release notes for any later StrongSwan versions, and/or try a different FOSS IPSec solutions, if at all possible. This message sounds hopelessly generic, but I'd at least wanted to let you know I didn't have the answer you were seeking for anyway 😕 ... View more

Thanks for your reply, Pankaj. I already in fact did that: I can see the ICMP echo request in the cluster, but no ICMP echo replies are ever seen.. I have already opened a support request with our integrator. I was hoping this whole thing to be a misconfiguration of some sort, but chances of that are getting slimmer.. ... View more

Hi Pankaj, Here's the output: aris@panix2(active)> show session all filter application ping source a.b.c.11 -------------------------------------------------------------------------------- ID          Application    State   Type Flag  Src[Sport]/Zone/Proto (translated IP[Port]) Vsys                                          Dst[Dport]/Zone (translated IP[Port]) -------------------------------------------------------------------------------- 333341       ping           ACTIVE  FLOW  NS   a.b.c.11[59216]/int-servers/1  (10.20.30.11[59216]) vsys1                                          172.26.16.6[328]/vpn  (172.26.16.6[328]) aris@panix2(active)> show session id 333341 Session          333341         c2s flow:                 source:      a.b.c.11 [int-servers]                 dst:         172.26.16.6                 proto:       1                 sport:       59216           dport:      39                 state:       INIT            type:       FLOW                 src user:    unknown                 dst user:    unknown         s2c flow:                 source:      172.26.16.6 [vpn]                 dst:         10.20.30.11                 proto:       1                 sport:       39              dport:      59216                 state:       INIT            type:       FLOW                 src user:    unknown                 dst user:    unknown         start time                           : Mon Aug 10 08:41:47 2015         timeout                              : 6 sec         total byte count(c2s)                : 102         total byte count(s2c)                : 0         layer7 packet count(c2s)             : 1         layer7 packet count(s2c)             : 0         vsys                                 : vsys1         application                          : ping          rule                                 : IS-V-001         session to be logged at end          : True         session in session ager              : False         session updated by HA peer           : False         address/port translation             : source         nat-rule                             : Internal Servers(vsys1)         layer7 processing                    : enabled         URL filtering enabled                : False         session via syn-cookies              : False         session terminated on host           : False         session traverses tunnel             : True         captive portal session               : False         ingress interface                    : ae2.105         egress interface                     : tunnel.2         session QoS rule                     : N/A (class 4)         tracker stage firewall               : Aged out         end-reason                           : aged-out ... View more

Update: I've also tried setting up a s2s with a Fortigate device (not my configuration), and I still see the same issue. Also note that the StrongSwan - Fortigate IPsec tunnel works OK. ... View more

Hi Pankaj, here you go (output redacted/sanitized): "100.100.139.9" is the PA "200.200.159.51" is the StrongSwan peer 10.20.30.0/25 is the post-NAT PA network 172.26.16.0/22 is the StrongSwan network aris@PA(active)> show session all filter protocol 50 -------------------------------------------------------------------------------- ID          Application    State   Type Flag  Src[Sport]/Zone/Proto (translated IP[Port]) Vsys                                          Dst[Dport]/Zone (translated IP[Port]) -------------------------------------------------------------------------------- 183171       ipsec-esp      ACTIVE  TUNN       100.100.139.9[51659]/vpn/50  (100.100.139.9[59260]) vsys1                                          200.200.159.51[21208]/vpn  (200.200.159.51[54121]) And this is the output of "ip xfrm policy" on the StrongSwan side: # ip xfrm policy src 10.20.30.0/25 dst 172.26.16.0/22         dir fwd priority 2887         tmpl src 100.100. 139.9 dst 200.200 .159.51                 proto esp reqid 1 mode tunnel src 10.20.30.0/25 dst 172.26.16.0/22         dir in priority 2887         tmpl src 100.100. 139.9 dst 200.200. 159.51                 proto esp reqid 1 mode tunnel src 172.26.16.0/22 dst 10.20.30.0/25         dir out priority 2887         tmpl src 200.200. 159.51 dst 100.100. 139.9                 proto esp reqid 1 mode tunnel src 0.0.0.0/0 dst 0.0.0.0/0         socket in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0         socket out priority 0 src 0.0.0.0/0 dst 0.0.0.0/0         socket in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0         socket out priority 0 src ::/0 dst ::/0         socket in priority 0 src ::/0 dst ::/0         socket out priority 0 src ::/0 dst ::/0         socket in priority 0 src ::/0 dst ::/0         socket out priority 0 ... View more

Hi Steven. That was my assumption on the first take. Then however I configured the two other peers (Cisco SOHO and Strongswan) and I see the same behavior.. Adding to my reply, the packet counter  for the SA from the Strongswan side *is* increasing (see line before last). This part of the output of "ipsec statusall": Security Associations (1 up, 0 connecting):       PA[1]: ESTABLISHED 20 minutes ago, 200.200.159.51[200.200.159.51]...100.100.139.9[100.100.139.9]       PA[1]: IKEv1 SPIs: 46112c603ecc9b01_i 5c5827074640bb75_r*, pre-shared key reauthentication in 7 hours       PA[1]: IKE proposal: AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_1536       PA{2}:  INSTALLED, TUNNEL, reqid 1, ESP SPIs: c9cb52d8_i d369e77c_o       PA{2}:  AES_CBC_256/HMAC_SHA2_512_256, 68712 bytes_i (818 pkts, 220s ago), 70644 bytes_o (841 pkts, 1s ago), rekeying in 20 minutes       PA{2}:    172.26.16.0/22 === 10.20.30.0/25 ... View more