Palo Alto Networks Knowledgebase: IPSec Traffic Being Discarded

IPSec Traffic Being Discarded

10203
Created On 02/07/19 23:55 PM - Last Updated 02/07/19 23:55 PM
VPNs
Resolution

Issue

The IPSec SA is up. The show vpn flow command shows 0 decap packets. The IPSec session in the session table shows discard-flow.

Cause

The IPSec packets coming into the PAN device were not ingressing the same interface where the IPSec tunnel was terminated, but instead entering on another interface and  being routed to the tunnel.   As a result, the IPSec session was in a discard-flow state and dropping all packets coming in on the VPN.

Resolution

The tunnel was moved to terminate directly on the ingress interface. The IPSec tunnel started seeing decap packet counters incrementing in the show vpn flow command ouput and traffic through the VPN worked fine.

owner: mrajdev



Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGcCAK&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language