topic Re: IPSec intermittent disconnection issue in General Topics

IPSec intermittent disconnection issue

AY_FASAR — Mon, 17 Mar 2025 14:22:44 GMT

Hi,

Is there a command to check if a tunnel went down on a specific time and why it happened.

I have a tunnel set-up to a 3rd party where they keep monitoring some of their servers. They inform me that they receive alarms every hour that the endpoint is down and its not coming back up for about 15 min.

I cant see anything obvious. I have done show vpn flow name ... but I cant see any error there. is there any other logs that I could check to see those disconnections that 3rd party mentioning and if I can get any clue from the output why the tunnels going down.

Re: IPSec intermittent disconnection issue

Brandon_Wertz — Mon, 17 Mar 2025 17:58:39 GMT

@AY_FASAR wrote:

Hi,

Is there a command to check if a tunnel went down on a specific time and why it happened.

I have a tunnel set-up to a 3rd party where they keep monitoring some of their servers. They inform me that they receive alarms every hour that the endpoint is down and its not coming back up for about 15 min.

I cant see anything obvious. I have done show vpn flow name ... but I cant see any error there. is there any other logs that I could check to see those disconnections that 3rd party mentioning and if I can get any clue from the output why the tunnels going down.

If you look in the GUI logs, (system) and filter on type of "VPN" (I think.) that should give you the logs you're looking for. I would also add time stamps filters with a "geq" (after - greater than equal to) & "leq" (before - less than equal to) for the time period you had VPN issues. You can look through the logs and find errors much easier that way.

Re: IPSec intermittent disconnection issue

AY_FASAR — Tue, 18 Mar 2025 10:11:10 GMT

all I can see is just the key negotiation, nothing else to suggest there is an issue. 3rd party insists that they sent traffic down the tunnel to us and that they get dropped our end. if they keep sending traffic, means the tunnel stays up all the time but there is some other issue.

Could the traffic getting dropped some how during the rekey phase? if there is possibility, is there a debug or packet capture to prove this? with packet capture it might be a bit tricky as the issue is intermittent.

Re: IPSec intermittent disconnection issue

nohash4u — Tue, 18 Mar 2025 16:23:34 GMT

@AY_FASAR to clarify your issue - the tunnel states it is up on both ends, but there is no traffic flowing through it? Working through something similar to this myself.

A few thoughts:

Could a Zone Protection Profile be blocking traffic?
I believe a packet capture may be best, especially with logging packet-diag features enabled.
An easy win - make sure NTP settings are valid on both ends of the tunnel.
It could be worthwhile to follow up with the ISP.
Is the far end device also a Palo Alto Networks NGFW?
Wildcard thought - MTU size?
What version of PAN-OS are you running?

Will keep you updated if I find RCA in my case.

Re: IPSec intermittent disconnection issue

AY_FASAR — Tue, 18 Mar 2025 21:13:08 GMT

I dont believe its NTP or anything similar, all other tunnels working fine. it's only this tunnel's 3rd party and the issue is intermittent.

Not sure what vendor is 3rd party's gateway but I can check.

Re: IPSec intermittent disconnection issue

nohash4u — Thu, 20 Mar 2025 15:38:35 GMT

Ok, sounds good. I will likely be opening a TAC case. I will keep you posted.

Re: IPSec intermittent disconnection issue

nohash4u — Mon, 14 Apr 2025 16:34:25 GMT

@AY_FASAR did you ever get a resolution? I thought I would provide an update from my end. The TAC case unfortunately fizzled out as dump level debugging was not enabled, and it was deemed unwise to leave this level of debugging on until the issue reoccurred given the strain it puts on the firewall. That being said, a senior engineer I work with noticed two things:

An unusual frequency of IKE rekeying.
The source IP of the IKE rekeying not aligning with the expected configuration on the firewall. This was attributed to an issue with the ISP, and is being investigated.

I hope this helps.