I have some non-GlobalProtect VPN clients that connect to my Palo Alto PA-3220 firewall. They worked fine on 10.0.x (10.0.5) for over a year just fine. These are VPN phones that use X-Auth.
After I upgraded to 10.1.6, they would disconnect in exactly 25 minutes. Since this was production impacting, I moved back to 10.0.5.
Has anyone else seen IPSec weirdness on the 10.1.x track?
Posted Jun 5, 2022, 4:16 PM UTC
I had a similar issue while on 10.1.4 if I remember correctly, but it was with a machine with the GlobalProtect client. In this case we attributed it to being potentially an issue with the router/firewall (Ubiqiti USG) that was at the client's Internet connection, where its deep/stateful packet inspection was dropping related packets after around the same amount of time. They were able to disable it on their end to mitigate the issue, but we never determined if the root cause was with the PA, the client's router/firewall, or the GlobalProtect client.
Your experience may be completely unrelated... But it does sound suspiciously close. Are there other details about the situation that you can share?
The VPN lifetime is set to 12 hours. I know some IKE renegotiation is around 75% so it can't be hitting that. They are Avaya phones with an IPSec client that supports AES-128 and SHA1. Also worth mentioning again that it was working for years on 10.0.x
I thought perhaps some IKE/IPSec cipher minimums were upgraded in 10.1, but if that was the case, it wouldn't connect at all. I have opened a case with the TAC and sent them a techsupport file - I was just hoping to get some subjective verification here.
I wonder if it could be related to PAN-181116. It is amazing that they broke something as critical as IPSec in GlobalProtect at this stage of PAN-OS maturity.
That was fixed in 10.1.5. Maybe they broke something in 10.1.6, but I'm not willing to try 10.1.5 to see on a production firewall. Sunday is my window of opportunity. 10.1.6 fixed other things I wanted, so I'm stuck on 10.0 again.
That resolved bug doesn’t mention X-Auth either, I’m just wondering if there’s a related underlying cause
[deleted]
Seeing similar issues in 10.1.5. TAC has been unhelpful