PA-200 SAP router dropping tunnel

PeterG — Thu, 22 Aug 2013 17:10:41 GMT

We have a PA-200 (running OS 5.0.4) being used as an SAP router. NAT translating between an inside 17.20.x.x address and an outside static global address (IP = a.b.c.d) which pushes all traffic to its VPN peer IP e.f.g.h. When a completely new session is initiated all goes well with phase 1 (time = x) and phase 2 (time = 6x) being accepted. However, a minute before the phase 2 is to expire the PA-200 sends out a re-negotiation for phase II which goes unanswered at which point it tears down phase as well and attempts to renegotiate phase 1, and getting no answer keeps trying again and again. Rebooting PAN and subsequently pinging the server brings the tunnel up. Has any one else encountered this issue?

Re: PA-200 SAP router dropping tunnel

HULK — Thu, 22 Aug 2013 20:22:50 GMT

Hello Sir,

Could you please take a packet capture for UDP port 500 on the PA firewall ( Between egress interface IP address and peer gateway IP address).

Thanks

topic PA-200 SAP router dropping tunnel in General Topics

PA-200 SAP router dropping tunnel

Re: PA-200 SAP router dropping tunnel