topic Palo Alto to Azure vpn tunnel fails at random in Next-Generation Firewall Discussions

Palo Alto to Azure vpn tunnel fails at random

shaishav.singh — Tue, 13 Jan 2026 07:21:35 GMT

We installed a PA 3440 at a customer site which is being used to create a VPN tunnel with Azure. Two links have been configured in fail over mode (currently manual). The VPN tunnel fails randomly and needs to be rest manually. we have raised the case with PA who are struggling with logs since last 2 weeks without a fix. Basic configuration of the firewall alongwith settings on azure side have been verified by the PA L3, but there is no diagnosis. The customer is going live within 24 hours and is understandably upset with PA and us. can someone please throw a light on what could be the problem.

Also the tunnel works on one link (ISP-a) and does not work at all on the other link (ISP-b). this too is not diagnosed by PA L3. Need urgent help on both

Re: Palo Alto to Azure vpn tunnel fails at random

Raido_Rattameister — Wed, 14 Jan 2026 15:06:37 GMT

When tunnel fails does it say due DPD?

You say one tunnel don't work at all.

Do you have default routes towards both ISPs with same metric?

In this case do you have "Strict Source Path" enabled in ECMP settings or do you use static route towards peer public IP to make sure that IPSec traffic is sent out from correct WAN interface?

Re: Palo Alto to Azure vpn tunnel fails at random

shaishav.singh — Mon, 19 Jan 2026 09:24:37 GMT

i will check with respect to your questions and revert - thanks