PCNSE · Question #498
A network administrator troubleshoots a VPN issue and suspects an IKE Crypto mismatch between peers. Where can the administrator find the corresponding logs after running a test command to initiate…
The correct answer is B. System logs. IKE (Internet Key Exchange) negotiation events, including crypto mismatches, are recorded in the System logs on a PAN-OS firewall, not in Traffic or Tunnel Inspection logs. When a VPN tunnel fails to establish due to a Phase 1 (IKE) mismatch - such as mismatched encryption…
Question
A network administrator troubleshoots a VPN issue and suspects an IKE Crypto mismatch between peers. Where can the administrator find the corresponding logs after running a test command to initiate the VPN?
Options
- AConfiguration logs
- BSystem logs
- CTraffic logs
- DTunnel Inspection logs
How the community answered
(18 responses)- B89% (16)
- C6% (1)
- D6% (1)
Explanation
IKE (Internet Key Exchange) negotiation events, including crypto mismatches, are recorded in the System logs on a PAN-OS firewall, not in Traffic or Tunnel Inspection logs. When a VPN tunnel fails to establish due to a Phase 1 (IKE) mismatch - such as mismatched encryption algorithms, hashing, DH groups, or lifetime values - the firewall generates System log entries with severity warnings or errors that describe the negotiation failure. Configuration logs record admin changes, Traffic logs record data-plane sessions (which never form if IKE fails), and Tunnel Inspection logs are for inspecting already-established tunnels.
Topics
Community Discussion
No community discussion yet for this question.