topic Re: Is there any reason that tunnel interface will go down in General Topics

Is there any reason that tunnel interface will go down

fozail — Sun, 04 Dec 2016 09:54:49 GMT

Hi There,

I configured two IPSEC VPN on PA, as PA has two ISP connectivity. Configured a PBF to forward the traffic through primary tunnel interface and enabled monitoring to monitor trust interface of remote PA. A route was configured to forward the traffic the traffic through secondary tunnel interface.

I found that traffic was always forwarded through secondary tunnel interface. Reviewed and could see that PBF is in DISABLED state as I had enabled if monitor is not successfull disable this PBF.

Reviewed and could see that PBF moniotr got failed because tunnel interface was down.

As I am not doing any tunnel monitoring, tunnel monitor should not go down at all if appliance is up and running.

Can you please let me know how to find out why tunnel interface went down?

Best Regards,

Fozail

Re: Is there any reason that tunnel interface will go down

santonic — Mon, 05 Dec 2016 09:01:44 GMT

Maybe there was no traffic to keep that tunnel alive.

Re: Is there any reason that tunnel interface will go down

TranceforLife — Mon, 05 Dec 2016 10:13:47 GMT

Hi,

Could you check ikemgr.logs:

> tail lines 100 mp-log ikemgr.log

Re: Is there any reason that tunnel interface will go down

fozail — Mon, 05 Dec 2016 15:24:54 GMT

Hi,

I reviewed ikemgr.log but could not find anything realted to this, I enabled debug for ikemgr.log as well but no luck.

Re: Is there any reason that tunnel interface will go down

fozail — Mon, 05 Dec 2016 15:25:46 GMT

Hi,

I mean to say that tunnel interface went down not IPSEC VPN.

Re: Is there any reason that tunnel interface will go down

BPry — Mon, 05 Dec 2016 16:10:30 GMT

Do you have a static or dymaic IP on both ends of the tunnel? If you go into the Montior and then the System tab using the ( subtype eq vpn ) query string will show you all VPN events, it may show you that the IKE or IPSEC didn't negotiate correctly or possibly were deleted before negotiating a new set of keys.

Re: Is there any reason that tunnel interface will go down

fozail — Mon, 05 Dec 2016 16:24:12 GMT

Hi,

I checked the system log with subtype as vpn, but could not find anything related to tunnel interface.

Attempted to review the output of the command "show log system | match tunnel.5" but no luck.

IPSEC VPN gets negotiated successfully, both phase-I and phase-II reflects green, only tunnel interface is down and hence the routes associated with that tunnel interface gets removed from routing table.

Re: Is there any reason that tunnel interface will go down

BPry — Mon, 05 Dec 2016 18:19:33 GMT

If you run show vpn ipsec-sa tunnel *name*, do you show anything under the ipsec? It sounds like you likely have a part of the configuaration malformed.

If tunnels are up but traffic is not passing through the tunnel:

Check security policy and routing.
Check for any devices upstream that perform port-and-address-translations. Because ESP is a layer 3 protocol, ESP packets do not have port numbers. When such devices receive ESP packets, there is a high possibility they may silently drop them, because they do not see the port numbers to translate.
Apply debug packet filters, captures or logs, if necessary, to isolate the issue where the traffic is getting dropped.