topic Re: Palo Alto with Cisco router, GRE goes down in Next-Generation Firewall Discussions

Palo Alto with Cisco router, GRE goes down

Sudqi_I — Sun, 16 Jul 2023 11:37:38 GMT

Palo Alto with Cisco router, GRE goes down after enabling the keep alive in Palo Alto side,

note that the GRE tunnel goes down from the Palo Alto side but still up from the Cisco side, but there is no ping reachability from both side

Does anyone have an idea

Thanks

Re: Palo Alto with Cisco router, GRE goes down

PavelK — Mon, 17 Jul 2023 23:49:04 GMT

Hello @Sudqi_I

could you confirm whether you enabled on Cisco side the keepalive under tunnel interface with command "keepalive"? Technically, GRE interface does not have any built-in mechanism to take tunnel down if the other side of the tunnel is unreachable. GRE is up as long as underlaying interface to build tunnel is up and it has a route to tunnel destination.

Kind Regards

Pavel

Re: Palo Alto with Cisco router, GRE goes down

Sudqi_I — Tue, 18 Jul 2023 07:54:40 GMT

Hi Pavel,

yes, you are right, we set up keepalive under a tunnel in the Cisco router,

but when it is enabled under Palo Alto it goes down after 30 seconds if we put the setup (10, 3) note that it still up in Cisco

and for the routes, it is directly connected, I don't think we should configure any static router, because we have reachability but lose it after a while