topic Re: IPSec Tunnel goes Down After Few Minutes in Next-Generation Firewall Discussions

IPSec Tunnel goes Down After Few Minutes

raghavendra.badiger — Mon, 15 May 2023 08:13:37 GMT

hi All,

I am facing a strange issue with IPSec tunnels built on Palo Alto firewalls.

Scenario:

1. On both ends we have Palo Alto firewalls(various models PA-220, PA440, PA-3220, PA-VM(AWS))

2. Public IP addresses of both ends are always reachable.

3. Tunnel lights always look GREEN.

4. Routing also is in place, either with Static or OSPF routes.

Issue seen:

Once tunnel is brought up with 'test vpn' command on CLI, connectivity gets established. However, after few minutes(5 to 10), connectivity automatically breaks and tunnel lights on firewalls on both ends are GREEN.

I tried:

- With various PAN-OS 10.x.x, no help.

- With various hardware and VM, no help.

- By changing routing protocols, no help.

- With and without assigning IP address to tunnel interfaces, but no help.

Please let me know if you have seen this issue or any guidance would be helpful.

Re: IPSec Tunnel goes Down After Few Minutes

S.Cantwell — Thu, 25 May 2023 22:48:51 GMT

It sounds like the test vpn cli command is enough to get P1 and P2 up, but without active traffic on it, is a security feature to down the VPN (but interfaces may still show green)

Suggestion is to setup tunnel monitoring, to ping a destination IP, to keep the tunnel up.

What other questions can we answer for you?

Re: IPSec Tunnel goes Down After Few Minutes

raghavendra.badiger — Fri, 26 May 2023 13:48:44 GMT

Yeah, this is a work around I agree. But this is not an actual fix.

Re: IPSec Tunnel goes Down After Few Minutes

Raido_Rattameister — Fri, 26 May 2023 13:55:23 GMT

Are you saying that test vpn brings tunnel up but generating interesting traffic does not (pinging across the tunnel to other side for example)?

What do you see in traffic log if you ping. Is traffic destination correct tunnel interface?