topic Ikev2 site to site VPN between Arista ETM and Palo Alto in General Topics

Ikev2 site to site VPN between Arista ETM and Palo Alto

msdphi — Mon, 17 Feb 2025 13:53:22 GMT

Hello Mams and Sirs,

I need your advice here.

I have configured an ikev2 policy based site to site VPN between our Palo Alto and client Arista ETM. I manage the Palo Alto.

The status of the VPN shows up. But, communication between the subnets(local and remote) stop abruptly until, I generate some traffic by pinging each of their VLANs/subnets from our server.

All the parameters look correct on both sides.

What I observed is that continuous pings from the Palo Alto side keep the communication up.

Is this a normal behaviour or does any change have to be made on either device? Please help.

Re: Ikev2 site to site VPN between Arista ETM and Palo Alto

kiwi — Mon, 17 Feb 2025 16:47:07 GMT

Hi @msdphi ,

Yes, IPSec tunnel comes up only when there is an interesting traffic destined to the tunnel.

Check the bullet "Interesting Traffic or On-Demand" on this page which explains:

https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/ipsec-vpn-basics/ipsec-vpn-tunnels

To provide uninterrupted VPN service, you can use the Dead Peer Detection capability along with the tunnel monitoring capability on the firewall:

https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/set-up-tunnel-monitoring

Hope this helps,

-Kim.

Re: Ikev2 site to site VPN between Arista ETM and Palo Alto

msdphi — Mon, 17 Feb 2025 18:51:49 GMT

Thank you, Kim.

I already have liveliness check enabled and tunnel monitoring won't be possible. Because the client has multiple VLANs. But, configure multiple monitoring IP address is not possible.

I may be wrong. Please advise.

Re: Ikev2 site to site VPN between Arista ETM and Palo Alto

kiwi — Tue, 18 Feb 2025 09:10:25 GMT

Hi @msdphi ,

Correct, tunnel monitoring only allows you to monitor one IP.

Why would you monitor more ? For Tunnel monitoring you usually monitor an IP closest to the tunnel IP.

If you want to check on different VLANs being available I think you should look into path monitoring instead.

Kind regards,

-Kim.

Re: Ikev2 site to site VPN between Arista ETM and Palo Alto

msdphi — Tue, 18 Feb 2025 10:01:00 GMT

Why would you monitor more ? For Tunnel monitoring you usually monitor an IP closest to the tunnel IP--- so, the problem is that unless I keep continuous pings going to each of their LAN gateways, the communication stops, though the vpn shows as up. But that's not a good solution. I thought we might phase 2 parameters there

If you want to check on different VLANs being available I think you should look into path monitoring instead.--- okay will check ..