topic Re: IPSec VPN Tunnel in General Topics

IPSec VPN Tunnel

Mitesh — Thu, 09 Oct 2025 10:28:14 GMT

Hi,

We recently migrated IPSec Tunnel from CP 9100 to CP 3800 appliance.

Post migration we are unable to see th tunnel traffic logs on CP 3800.

Required blades is enable on CP3800 gateway.

What we are missing here ?

Re: IPSec VPN Tunnel

Chris_Atkinson — Thu, 09 Oct 2025 12:43:33 GMT

Are you seeing any logs for the 3800 or is it logging locally?

Use "cpstat fw -f log_connection" to check...

Re: IPSec VPN Tunnel

the_rock — Sun, 12 Oct 2025 18:10:13 GMT

You cant see just vpn logs or any logs? Sorry, its not entirely clear from your description.

Best,

Andy

Re: IPSec VPN Tunnel

the_rock — Wed, 15 Oct 2025 08:41:51 GMT

Hey @Mitesh

Were you able to fix this mate?

Andy

Re: IPSec VPN Tunnel

Mitesh — Fri, 17 Oct 2025 11:08:06 GMT

@the_rock unable to resolve the issue.

Let me explain the secnario once again, also attaching network diagram.

We are having 2 tier firewall architecture, Checkpoint we are using for Perimeter & Palo Alto for internel (core), server farm is behind the Palo Alto Firewall.

IPSec Tunnel is configured on Checkpoint, Tunnel is up, traffic from remote network is reaching to checkpoint, but we are unable to see the traffic on Palo Alto Firewall.

I suspect may be routing or NAT issue.

Re: IPSec VPN Tunnel

the_rock — Fri, 17 Oct 2025 11:13:19 GMT

Ok...do you see any drops on CP side? What about PAN?

Re: IPSec VPN Tunnel

Mitesh — Fri, 17 Oct 2025 11:15:01 GMT

Palo Alto sidw we are not seeing any packet.

Re: IPSec VPN Tunnel

the_rock — Fri, 17 Oct 2025 11:17:19 GMT

On CP fw, do this from expert -> fw ctl zdebug + drop | grep x.x.x.x

Just replace with right IPon other side. Its been forever since I worked with PAN, so not sure if they have similar command, but you can check the logs.

Re: IPSec VPN Tunnel

the_rock — Fri, 17 Oct 2025 11:19:05 GMT

Then for sure sounds its issue on their end, not CP.

Re: IPSec VPN Tunnel

Mitesh — Fri, 17 Oct 2025 11:30:14 GMT

How we can verify trafiic is reaching to Palo Alto Interface via Checkpoint ?

Re: IPSec VPN Tunnel

the_rock — Fri, 17 Oct 2025 11:40:08 GMT

Just do tcpdump or fw monitor. You can refer to below site my colleague made while back.

https://tcpdump101.com

Re: IPSec VPN Tunnel

Mitesh — Wed, 22 Oct 2025 06:32:29 GMT

@the_rock issue got resolved.

It was routing issue from Palo Alto side.

Re: IPSec VPN Tunnel

the_rock — Wed, 22 Oct 2025 11:16:21 GMT

Excellent, thanks for letting us know.