topic Re: Disable an IPSec Tunnel in General Topics

Disable an IPSec Tunnel

blandis — Fri, 25 Apr 2014 14:23:09 GMT

I want to disable an IPSec VPN. I have currently blocked traffic both directions to the tunnel by using a Security Policies, but there should be a way to disable the tunnel in the IPSec configuration (or alternatively, disable the tunnel interface). I don't want to delete it, but I don't want it taking up processor speed for a tunnel that I don't want turned on.

Re: Disable an IPSec Tunnel

jvalentine — Fri, 25 Apr 2014 14:41:31 GMT

Currently, there isn't a nice "disable" button for IPSec Tunnel Configuration - but I do see the value in being able to disable tunnels at-will. For this case, I have created an "IKE Gateway" called "disabled" and populated it with bogus information. Then, when I need to disable a tunnel, I go change the IKE Gateway to "disabled" and commit. It has the same effect - and I've deleted nothing.

Hope that helps.

Re: Disable an IPSec Tunnel

blandis — Fri, 25 Apr 2014 14:44:20 GMT

That is a possible workaround, but it will still try to connect, using CPU and continuous log messages.

Re: Disable an IPSec Tunnel

jvalentine — Fri, 25 Apr 2014 14:55:15 GMT

Agreed - it's a workaround - not a complete solution.

Ultimately, if you want a "disable" button in the IPSec configuration, you'll need to file a Feature Request with your local Palo Alto Networks sales engineer.

Re: Disable an IPSec Tunnel

blandis — Fri, 25 Apr 2014 15:26:01 GMT

Actually, this might cause alarms on the opposing firewall, which I don't want, so maybe a security block is a better solution anyways.

Re: Disable an IPSec Tunnel

carpediem79 — Fri, 25 Apr 2014 16:08:38 GMT

I agree that this would be a nice feature. I ran into an issue a couple of days ago where the VPN link between our PA and a Cisco ASA died after a software upgrade on the PA. I had no way kick start the PA to get it to retry making a connection to the remote site. I had to go into the CLI to do this. Having buttons on the GUI to be able to test the link or reset the link would be handy.

I also noticed that the link status never even updated when the link went down, which is concerning.