topic Re: Palo Alto - Barracuda IPsec VPN problems in General Topics

Palo Alto - Barracuda IPsec VPN problems

ChrisCon — Mon, 15 Nov 2021 14:12:47 GMT

We've a IPsec-VPN IKEv2 between Palo Alto (10.0.7) and Barracuda (8.0.5-0341) with 10 IPsec tunnels, one VPN-tunnel per subnet-pair, on Palo side "proxy IDs".

At least once every day, some of these ipsec-tunnels go down and can only be forced to come up again with manual "initiate" on Barracuda.
The Palo Alto is set to passive.

Normally, every 35 - 45 minutes a new ipsec-tunnel for a subnet-pair is installed and the old one deleted (logs on both sides). But when the error occurs, the newly established ipsec-tunnel is deleted immediatly (in the same second) after is has been installed.
These logs also are seen on both ends of the tunnel, so it can not be sayed which end causes the problem and why.
Then it is down until manual "initiate".
Any ideas?
Of course we checked timers, subnets and masks etc.
Thanks.

Re: Palo Alto - Barracuda IPsec VPN problems

OtakarKlier — Mon, 15 Nov 2021 15:41:41 GMT

Hello,

When the tunnels go down, is there lack of traffic? Meaning some devices, not sure about Barracuda, will drop tunnels if no traffic is going across them. If you setup tunnel monitor, the PAN will send a ping periodically across the tunnel to help keep it up.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/vpns/set-up-site-to-site-vpn/set-up-tunnel-monitoring.html#ida640225c-92d3-4fcb-a4b3-274777fd063c

Hope that helps.

Re: Palo Alto - Barracuda IPsec VPN problems

ChrisCon — Mon, 15 Nov 2021 15:58:30 GMT

Thanks four reply.
But we already are pinging through some of the tunnels (5 minutes intervall) and there it also happens.
And I think the ipsec-tunnel should be coming up when traffic is going through it, even when there was some time without traffic, otherwise it is useless.

Re: Palo Alto - Barracuda IPsec VPN problems

Iselith — Wed, 11 May 2022 06:52:20 GMT

Hey 🙂

We have the same issue. Could you figure out what the problem was?

Re: Palo Alto - Barracuda IPsec VPN problems

ChrisCon2355 — Wed, 11 May 2022 07:28:36 GMT

Unfortunately not. We moved from Barracuda (Azure cloud) to the Azure-VPN-GW

Re: Palo Alto - Barracuda IPsec VPN problems

Iselith — Thu, 12 May 2022 21:06:19 GMT

Hmm 😞 We have a F280 on Prem at our office and have the issue you have described with a palo alto on the other side.

A fix would be great 🙂 Or when someone has an idea.

The question in my opinion is which firewall causes this. Barracuda or Palo.

Re: Palo Alto - Barracuda IPsec VPN problems

OtakarKlier — Fri, 13 May 2022 20:08:42 GMT

Hello,

I just reread the initial issue, any reason you have 10 tunnels between the two devices? 1 is sufficient, its all encrypted.

Regards,

Re: Palo Alto - Barracuda IPsec VPN problems

Iselith — Mon, 16 May 2022 06:59:18 GMT

We have only 1 Tunnel with 8 local networks as an IKEv2 Tunnel.

But we have the same problem as in the beginning question.

We run a Barracuda F280. The other Side has a Palo Alto PA-5250

Re: Palo Alto - Barracuda IPsec VPN problems

Iselith — Tue, 17 May 2022 07:04:40 GMT

So no one has an idea ?

Re: Palo Alto - Barracuda IPsec VPN problems

OtakarKlier — Tue, 17 May 2022 19:41:22 GMT

Hello,

The only other thing I could suggest is to try Ikev1.

Regards,

Re: Palo Alto - Barracuda IPsec VPN problems

maierfl — Fri, 01 Jul 2022 09:19:03 GMT

Hi guys,

we had the same issue you're describing and got the recommendation from Barracuda Support to use "IKE Reauthentication" and disable "Restart SA on Close" at the tunnel settings if the partner is a Palo Alto.

That worked for us and the tunnel is stable since we changed the settings.

Re: Palo Alto - Barracuda IPsec VPN problems

SimonStef — Thu, 14 Jul 2022 13:28:33 GMT

Hi All,

We had this problem, tried a lot of things and were getting nowhere. We were using multiple Proxy IDs /24 networks on the Palo Altos as well.

We changed IKE Phase 1 lifetime to 86400 seconds (24 hours)

Kept IKE Phase 2 lifetime to 3600 seconds

And what I believe resolved the issue, summarized the /24 Proxy ID networks to a couple of /19 Proxy IDs that covered most networks.

This reduced the IPSec VPN tunnels being created and resolved the issue. We still kept a couple of /24 networks that couldn't be summarized, but we reduced the Proxy ID entries from 20+ to 5.

I hope this helps.

Regards,

Simon

Re: Palo Alto - Barracuda IPsec VPN problems

Iselith — Thu, 11 Aug 2022 10:11:42 GMT

No one here who has an other idea except Ikev1 ?

Re: Palo Alto - Barracuda IPsec VPN problems

CGoulard — Tue, 24 Feb 2026 14:23:28 GMT

We had the exact same issue.

Here is the situation:

PA-5250 PANOS 10.2.7-h24. Had to upgrad due to packet buffer congestion issues on this PANOS version (supposedly fixed but not).

Upgraded to PANOS 11.1.10-h1. This version has a known issue with IPSEC tunnels and Dynamic NATs, but since we're not using Dynamic NATs, we have been cleared.

After upgrading to 11.1.10-h1, we started noticing daily that 1/7 Proxy IDs would drop for hours. Come back, drop later. Once traffic died down, everything seemed to stabilize.

We found this post, and the mention about too many proxy IDs resonated with us. We provide this link to TAC to look into it and confirm, and crickets. Not sure they even read it.

We contacted the other vendor using Barracuda firewalls, and worked with them to remove 7 individual Proxy IDs and replace with a /23 subnet, and things have been stable since.

It's apparent that Barracuda has issues, with too many Proxy IDs, and this post here is what we attribute to resolving our issue.