topic Palo Alto Site to Site IPsec VPN went down in Next-Generation Firewall Discussions

Palo Alto Site to Site IPsec VPN went down

EvanRaci — Wed, 26 Apr 2023 13:24:36 GMT

Hi ,

We've setup Site to Site IPsec VPN between Palo Alto Firewalls. The tunnel was up and working but it went down after some time.

Look like the tunnel went down because there is no traffic passing through the tunnel. Everytime we need to trigger IPsec tunnel by using >test vpn ike-sa gateway to bring up.

How can we configure the tunnel to be up all the time even there is no traffic passing through the tunnel?

Do we need to enable tunnel-monitor ? Are there any other ways to make the tunnel up all the time?

We are using IKEv2 preferred mode and we already enabled DPD for Ikev1 and liveliness check for ikev2.

Please help suggest.

Re: Palo Alto Site to Site IPsec VPN went down

Raido_Rattameister — Wed, 26 Apr 2023 18:08:31 GMT

Either tunnel monitor or path monitoring inside virtual router.

Without them tunnel will not be renegotiated if no interesting traffic.

Re: Palo Alto Site to Site IPsec VPN went down

EvanRaci — Mon, 05 Jun 2023 06:25:08 GMT

After Checking Config , the issue is DH value mismatch. Change both side to same DH Value and now working fine