topic Re: VPN Phase 2 Tunnel stuck in Next-Generation Firewall Discussions

VPN Phase 2 Tunnel stuck

ISG-JHAH — Thu, 05 Jan 2023 22:47:28 GMT

Hi,

We have multiple S2S VPN with many vendors but facing issue with Fortinet.

On our side we observe Phase 2 tunnel is up and packets are going out through Tunnel interface but no reply. Other party saying no issue on their end but once we restart that Phase 2 Proxy id, it starts working.

Just to inform you that we have multiple Proxy ids. all Proxy ids Tunnels comes up different time and face issue at different time so need to restart only that proxy id tunnel.

Kindly let me know how to troubleshoot it either issue is at our end or their end.

Re: VPN Phase 2 Tunnel stuck

nikoolayy1 — Sat, 07 Jan 2023 17:28:00 GMT

Just make your Palo Alto the VPN responder so you can see more details in the GUI System logs:

How to make Palo Alto Networks firewalls Responder-only in an IPSec tunnel

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClMZCA0

Also maybe the other firewall is using policy based VPN:

Proxy-ID for VPNs Between Palo Alto Networks and Firewalls with Policy-based VPNs

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClW8CAK

Re: VPN Phase 2 Tunnel stuck

Arnesh — Mon, 09 Jan 2023 06:59:02 GMT

Hi @ISG-JHAH

Are you checking the status of the IPSec from GUI? The status of the Phase-2 will stay UP (Green on GUI) as long as even 1 proxy ID is UP among all in Phase-2 tunnels.
Please check if the status of the proxy-ID is indeed UP? To check the status, run the below command from the CLI.

show vpn tunnel name <name-of-proxy-id>
You will get information like LOCAL PROXY ID, REMOTE PROXY ID, ports etc in output.

The VPN logs generated as responder gives more information as suggested by
You can review the system logs and ikemgr logs, during the issue time frame.

You can also refer to the below KBs:

How to Troubleshoot IPSec VPN connectivity issues

IKEv1 VPN error logs - Troubleshooting

IPSec and Tunneling Resource list on Configuring and Troubleshooting

Regards,

Re: VPN Phase 2 Tunnel stuck

nikoolayy1 — Mon, 09 Jan 2023 17:30:54 GMT

Yes as @Arnesh mentioned if needed enable debug for extra info. This is also a usefull link: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcKCAS