Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
Hi there,
I am experiencing a weird behavior of my VM-Series PA running PanOS 10.0.4
I am trying to construct 2 VPN tunnels. First tunnel is IKEv1 toward CiscoASA. This tunnel is up and running like a charm.
However, my second tunnel toward a Google Cloud VPN, using IKEv2, my PA is ignoring the IKE_SA_INIT from the Google.
I have check all configuration are good and matched on both end. The following is puzzling me.
1) I used Packet Capture (GUI) to capture the raw packets and examine the traffic using Wireshark. I am able to see the incoming IKE_SA_INIT request from Google addressing to my PA IP at UDP port 500. But, there is no single reply from PA. It is like unidirectional traffic, I have ensured my filter is monitoring both way because I can see traffic toward Cisco ASA in the capture.
2) I then turned on the ike debug by running "debug ike global on debug" and "tail follow yes mp-log ikemgr.log". To my surprise, I did not see any IKE_SA_INIT from Google in the log. Note : I can see the detail transaction from Cisco ASA.
3) I then turned on the pcap debug by using "debug ike pcap on" and use "view-pcap no-dns-lookup yes no-port-lookup yes follow yes debug-pcap ikemgr.pcap" . Again, I can't see any traffic from Google. The Google is sending the IKE_SA_INIT repeatedly. But I can't see even a single one.
I am wondering if anyone have any clue about this weird behavior?
p/s : I noticed in the wire-shark that the same INIT was also forwarded to an IP in my INT zone where 10.128.140.69 is my EXT IP and 10.128.140.160 is my app server (proxy id) sitting in INT zone which can't be reach from internet. Why am I see that packet?
Regards
Bernard
.pcap.png){kind=link}