topic Re: VPN Status in General Topics

VPN Status

minow — Tue, 21 Feb 2017 07:32:24 GMT

hey all

i have a 2 sites and we have between them 2 VPN tunnels (different ISPs) and on top of the VPN i am running OSPF

for some reason i see a lot of times that the IKE Gateway status is RED , but on the SSH i do see that i have an IKE-SA.

what i notice is that after i run "test vpn ike-sa gateway Boston-HOT" on one PA the status goes to GREEN , after i run "clear vpn ike-sa gateway Boston-HOT" it goes to RED but i still have the IKE-SA between the PAs, also while "RED" te OSPF peer seems to still be availible using both of the tunnel interface

is this make sense?

Re: VPN Status

santonic — Tue, 21 Feb 2017 08:04:49 GMT

The situation when phase 1 has expired and phase 2 is alive (and VPN working) is normal:

https://live.paloaltonetworks.com/t5/Management-Articles/IPSEC-VPN-IKE-Phase-1-is-Down-but-Tunnel-is-Active/ta-p/53085

test vpn ike-sa gateway Boston-HOT tries to establish phase 1 so that will make it go green (if parameters are ok)

clear vpn ike-sa gateway Boston-HOT will delete phase 1 but leaves phase 2 as it is. So yeah, this will make phase 1 red again but leave phase 2 and SA as it is.

Re: VPN Status

TranceforLife — Tue, 21 Feb 2017 15:54:47 GMT

removing my post as @santonic already replied 🙂