topic Re: PBF and Tunnel monitoring failing in General Topics

PBF and Tunnel monitoring failing

Nick.Spender — Mon, 09 Apr 2018 18:18:35 GMT

Hello

I have strange intermittant issue with PBF and Tunnel monitoring. If I disable the IPsec VPN at both side and bring it up PBF and Tunnel monitoring is working at configured. ( Shows as up ) I have configured a monitor IP destination of an address across the tunnel. Randomly the PBF and Tunnel monitoring fails. Even thou the IPsec VPN is up. If I use CLI to ping the destination using 'ping source tunnel interface IP host monitor IP ' it passes absolutely fine. If I remove the monitored IP and just keep 'disable this rule if monitor/nexthop ip is unavailable' clicked. The PBF actually is working. System logs do not show it as back up but traffic is being forwarded as per the configuration of the PBF.

I have read both the below articles
https://live.paloaltonetworks.com/t5/Management-Articles/PBF-Rule-is-not-Working-When-PBF-Monitoring-is-Enabled-for-the/ta-p/62334
https://live.paloaltonetworks.com/t5/Configuration-Articles/Understanding-behavior-of-PBF-and-Tunnel-monitoring-probes/ta-p/68666

Any ideas anyone

Thanks in advance

Re: PBF and Tunnel monitoring failing

reaper — Tue, 10 Apr 2018 08:22:48 GMT

hi @Nick.Spender

Is there a static route for the monitor ip that ensures packets are sent into the tunnel? monitors can't use pbf to reach their destination

did you use a single VR for both VPN tunnels or did you go with the dual-VR design?

Re: PBF and Tunnel monitoring failing

Nick.Spender — Tue, 10 Apr 2018 08:56:10 GMT

@reaper

Hello,I hope your well. I went down the 1 VR with Static route path monitoring for 0.0.0.0/0, WAN failover seems to work fine. Yes there is a static route for the tunnel. tunnel interface IP is also included in the proxy ID's in the IPsec config. Same at the other end.

Thank you 🙂