topic Re: Tunnel Monitor with AWS in General Topics

Tunnel Monitor with AWS

SoftMochi — Tue, 23 Nov 2021 01:48:13 GMT

Hello Everyone

Does Tunnel monitor work PA - AWS IPSec ?

I've heard it will not work, only PA - PA Connection

I'd appreciate it if you could help me !

Thanks !

Re: Tunnel Monitor with AWS

BPry — Tue, 23 Nov 2021 02:10:40 GMT

@SoftMochi,

The tunnel monitoring feature itself will work perfectly fine, it's just using ICMP to monitor the given host. While PAN technically considers it to be a "proprietary" feature, it works with any ICMP enabled host regardless of what the tunnel peer is.

Re: Tunnel Monitor with AWS

SoftMochi — Tue, 23 Nov 2021 02:18:19 GMT

Thank you for reply 🙂

then, I have one question

In this picture, as you can see, tunnel monitor is down now

so can I understand peer is not allow icmp now ?

Re: Tunnel Monitor with AWS

BPry — Tue, 23 Nov 2021 02:30:20 GMT

@SoftMochi,

It means that the tunnel IP (used by default with tunnel monitoring) can't send/receive ICMP traffic to the specified tunnel monitoring host. Sometimes you'll see people create a tunnel interface without assigning an IP, but one is required for tunnel monitoring to function.

Re: Tunnel Monitor with AWS

SoftMochi — Tue, 23 Nov 2021 03:22:19 GMT

So,

1. Make the tunnel interface and tunnel IP

2. Allow ICMP at tunnel interface

3. Config tunnel monitor destination ip(Network -> IPSec Tunnels)

Is it right ?

I'm sorry for bother you ...

Thanks