topic IPSEC VPN tunnel in General Topics

IPSEC VPN tunnel

Ozman4169 — Mon, 13 Nov 2023 13:29:10 GMT

We have a site to site VPN tunnel that fails when the vendor side tries to Re-Key. We are seeing no U-Turn policy blocking them. We can ReKey from outside without issue.

1. Has anyone seen this issue previously and been able to fix it?

2. Does anyone have a script that can be run that will logon our firewall and allow me to run 2 commands to reset the tunnel instead of running the commands manually?

Any help would be appreciated.

Re: IPSEC VPN tunnel

kiwi — Mon, 20 Nov 2023 09:09:41 GMT

Hi @Ozman4169 ,

You could automate this using API script:

https://live.paloaltonetworks.com/t5/automation-api-discussions/using-api-to-reset-ipsec-tunnel/td-p/93438

That said, I would recommend doing some further debugging to find the root cause.

You might find more information in the ikemgr logs in debug mode. For this please refer the below documents : > https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC : HOW TO TROUBLESHOOT IPSEC VPN CONNECTIVITY ISSUES > https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcKCAS : HOW TO ENABLE DEBUG ON A SINGLE VPN PEER?

Kind regards,

-Kim.

Re: IPSEC VPN tunnel

reaper — Mon, 20 Nov 2023 09:40:16 GMT

you can ask the remote peer to set their tunnel to passive mode, which should prevent them from rekeying

Usually when something like this pops up, in my experience it's been because the remote side is not set to one single set of crypto options, but has a bunch that complicate the negotiation

either have the remote side use a more specific crypto profile, or set up debugging for the peer gateway and tunnel and see which proposals they send, and adjust your crypto settings to use a more compatible set