topic Re: VPN tunnel flapping after the 11.1.4-h7 upgrade in General Topics

VPN tunnel flapping after the 11.1.4-h7 upgrade

SudarshanKasat03 — Wed, 05 Mar 2025 05:21:19 GMT

We have upgraded our FW to 11.1.4-h7. After the upgrade the IPSEC tunnels were working fine. But from the past 2 days we are observing that tunnels are flapping and one of the tunnel is down due to phase-1 negotiation failure due to timeout.

Does anyone else facing the same issue? or faced the issue earlier like this?

Re: VPN tunnel flapping after the 11.1.4-h7 upgrade

kiwi — Wed, 05 Mar 2025 11:57:33 GMT

Hi @SudarshanKasat03 ,

Some extra debugging might be required to find the root cause.

I recommend checking out the following Support FAQ that focusses on troubleshooting VPN connectivity issues:

https://live.paloaltonetworks.com/t5/support-faq/support-faq-how-to-troubleshoot-ipsec-vpn-connectivity-issues/ta-p/590317

Kind regards,

-Kim.

Re: VPN tunnel flapping after the 11.1.4-h7 upgrade

OtakarKlier — Wed, 05 Mar 2025 15:26:13 GMT

Hello,

While this was a long time ago working with other firewalls. When we saw this type of behavior, we would 'rebuild' the tunnels. Sometimes it was just a matter of changing the pre-shard keys. Sometimes it was to deleted the tunnel config and build new. I dont know if this will solve the issue you are facing, but it could be a bug in the code. In this case if the PSK or rebuild hasn't resolved the issue, I would open a TAC case.

Hope this helps.