topic Re: IPSEC Tunnel Down, All configuration is okay in Next-Generation Firewall Discussions

IPSEC Tunnel Down, All configuration is okay

S.Negi324206 — Wed, 15 May 2024 11:44:10 GMT

Hi,

I have created a site to site tunnel, both devices are Paloalto firewall; One Firewall is PA 820 and another one is PA 410

All the configuration is okay but tunnel is down.

We are ping public IP of PA 410 from PA 820, But Not able to ping public IP of PA 820 from PA 410 as ICMP is blocked for PA 820 Public IP.

Please suggest any solution.

Raido_Rattameister — Wed, 15 May 2024 12:33:46 GMT

Does "test vpn ipsec-sa tunnel <name>" from firewall cli bring up the tunnel?

S.Negi324206 — Wed, 15 May 2024 12:40:24 GMT

Already tried this command but still tunnel down.

Raido_Rattameister — Wed, 15 May 2024 12:50:47 GMT

Logs on initiator side show only if it times out.

You need to check logs on destination side as only destination shows details if there is config mismatch.