PA-3200/5200 capture pas les ESP paquets entrants du Protocole 50 dans l’étape Recevoir
17817
Created On 10/25/19 02:21 AM - Last Modified 10/15/25 10:05 AM
Symptom
- PA-32xxx et PA- 52xx ne Firewall capturent pas les ESP paquets au stade De recevoir.
- Ça n’a pas d’impact sur le trafic.
- Filtre configuré activé PA-3220 et initié le trafic en envoyant ping.
admin@Lab34-77-PA-3220> debug dataplane packet-diag show setting
--------------------------------------------------------------------------------
Packet diagnosis setting:
--------------------------------------------------------------------------------
Packet filter
Enabled: yes
Match pre-parsed packet: no
Index 1: 0.0.0.0/32[0]->0.0.0.0/32[0], proto 50 <<<<<<<<<<< for ESP
ingress-interface any, egress-interface any, exclude non-IP
Index 2: 34.34.34.1/32[0]->34.34.34.2/32[0], proto 0
ingress-interface any, egress-interface any, exclude non-IP
Index 3: 34.34.34.2/32[0]->34.34.34.1/32[0], proto 0
ingress-interface any, egress-interface any, exclude non-IP
Index 4: 0.0.0.0/0[0]->0.0.0.0/0[0], proto 0
ingress-interface ethernet1/1, egress-interface any, exclude non-IP
--------------------------------------------------------------------------------
Logging
Enabled: yes
Log-throttle: no
Sync-log-by-ticks: yes
Features:
flow : basic
tunnel : flow
Counters:
--------------------------------------------------------------------------------
- Ping a commencé entre les adresses du tunnel IP pour initier le tunnel
admin@Lab33-198-PA-3220> ping source 33.33.33.2 host 33.33.33.1 PING 33.33.33.1 (33.33.33.1) from 33.33.33.2 : 56(84) bytes of data. 64 bytes from 33.33.33.1: icmp_seq=2 ttl=64 time=1.48 ms 64 bytes from 33.33.33.1: icmp_seq=3 ttl=64 time=1.46 ms 64 bytes from 33.33.33.1: icmp_seq=4 ttl=64 time=1.45 ms 64 bytes from 33.33.33.1: icmp_seq=5 ttl=64 time=1.45 ms 64 bytes from 33.33.33.1: icmp_seq=6 ttl=64 time=1.48 ms 64 bytes from 33.33.33.1: icmp_seq=7 ttl=64 time=1.37 ms 64 bytes from 33.33.33.1: icmp_seq=8 ttl=64 time=1.45 ms 64 bytes from 33.33.33.1: icmp_seq=9 ttl=64 time=1.46 ms 64 bytes from 33.33.33.1: icmp_seq=10 ttl=64 time=1.48 ms 64 bytes from 33.33.33.1: icmp_seq=11 ttl=64 time=1.56 ms 64 bytes from 33.33.33.1: icmp_seq=12 ttl=64 time=1.47 ms 64 bytes from 33.33.33.1: icmp_seq=13 ttl=64 time=1.50 ms 64 bytes from 33.33.33.1: icmp_seq=14 ttl=64 time=1.49 ms 64 bytes from 33.33.33.1: icmp_seq=15 ttl=64 time=1.44 ms ^C — 33.33.33.1 ping statistics — 15 packets transmitted, 14 received, 6% packet loss, time 14025ms rtt min/avg/max/mdev = 1.373/1.471/1.565/0.055 ms admin@Lab33-198-PA-3220>
- Debug Dataplane Logs afficher ce qui suit PA-3220 sur:
admin@Lab33-198-PA-3220> . . . == 2019-07-23 12:53:07.557 -0700 == Packet received at ingress stage, tag 0, type ORDERED Packet info: len 342 port 64 interface 64 vsys 1 Pattern not found (press RETURN) <<<<<<<<<<<<<<<<<<<<<<
On Wireshark, Received Packets on PA-3220 vs PA-3020: - ESP packets can be seen on PA-3020 firewall.
- There were no ESP packets at receive stage on PA-3220 firewall.
Environment
- PA-3200
- PA-5200
- PAN-OS 8,1 et PAN-OS 9,0
Cause
La cause profonde est que les ESP pkts correspondant à la session tunnel seront décapsulés à l’étape et ceux NP qui ont sauté la capture pkt étape recevoir.
Resolution
Il n’y a pas de solution ou de solution de contournement. Le problème a été PAN-122181 signalé dans et devrait être fixé en PAN-OS 8.1.12 et PAN-OS 9.0.6.
Additional Information
- PA-32x00/5200 ne capture pas les ESP paquets entrants du Protocole 50 dans l’étape Recevoir
- PA-52xx ne capture pas les ESP paquets entrants du Protocole 50 à l’étape de recevoir (dupés à PAN-122181 )