Intermittent tunnel down between HUB and satellite

fatboy1607 — Fri, 16 Jan 2015 11:22:32 GMT

intermittenly we are seeing tunnel go down between HUB and satellite office and getting notification.

GlobalProtect Site to Site Gateway tunnel monitor down.Tunnel monitoring failed on tunnel interface:tunnelXXX to Satellite XXXX due to: Satellite not available

any help with troubleshooting steps would be helpful.

Re: Intermittent tunnel down between HUB and satellite

dreputi — Fri, 16 Jan 2015 12:17:14 GMT

Hello Mandar,

Check the following CLI output:

> show global-protect-satellite current-gateway

It will tell details of tunnel like:

Tunnel Monitor Enabled : Yes

Tunnel Monitor Interval : 3 seconds

Tunnel Monitor Action : fail-over

Tunnel Monitor Threshold : 5 attempts

Tunnel Monitor Source : 10.11.12.12

Tunnel Monitor Destination : 172.16.1.254

Tunnel Monitor Status : Up

Make sure you have proper connectivity between the above source and destination, also if there are any route flaps as you mentioned it is intermittent.

Useful resources you may refer:

Large Scale VPN (LSVPN) Deployment Guide

Useful commands from this doc:

Gateway/Portal

show global-protect-gateway gateway type satellite- To view the gateway configuration summary.

show global-protect-gateway flow-site-to-site- To view the established tunnel state.

show global-protect-gateway flow-site-to-site tunnel-id <number> or show global-protect-gateway flow-site-to-site name

<tunnel name > - To view the established tunnel details. You can view the tunnel-id using the command - show globalprotect-gateway

flow-site-to-site

show global-protect-gateway current-satellite- To view the details of current satellite.

Satellite

request global-protect-satellite get-gateway-config satellite <name> gateway-address <ip_address>- To fetch the

configuration from the gateway if any configuration changes are made to the gateway. By default, the gateway configuration

is refreshed every 2 hrs.

request global-protect-satellite get-portal-config satellite <name>- To fetch the configuration from portal. By default, the

gateway configuration is refreshed every 24 hrs.

test global-protect-satellite gateway-connect gateway-address <IP address> method activation satellite <name>- Trigger

GlobalProtect satellite connects to gateways.

Hope that gives some info.

Regards,

Dileep

topic Intermittent tunnel down between HUB and satellite in General Topics

Intermittent tunnel down between HUB and satellite

Re: Intermittent tunnel down between HUB and satellite