topic Re: Phase 1 is down but phase 2 is up- test vpn phase 1 and 2 in General Topics

Phase 1 is down but phase 2 is up- test vpn phase 1 and 2

MP18 — Wed, 30 Jan 2019 01:48:52 GMT

we have tunnel from PA to vendor which is using Cisco ASA.

When there is no interesting traffic tunnel is down by design this part is ok.

but today i saw phase 1 as red and phase 2 as green on gui.

I did the

test vpn ike command and phase 1 was green

but i was unable to ping across tunnel i see traffic going via tunnel but no replies.

Then i did

test vpn ipsec

i was able to ping lan device at other end.

need to know when phase shows down then is it best practice to use the test command for both phase 1 and 2?

when both phase 1 and 2 shows green and you can not ping across tunnel, you traffic going but no reply then should we use test command for phase 1 and phase 2?

Re: Phase 1 is down but phase 2 is up- test vpn phase 1 and 2

BPry — Wed, 30 Jan 2019 04:17:25 GMT

@MP18,

Phase 1 doesn't need to show as active to still have a tunnel up and running. Essentially Phase 1 is just there to setup a secure channel for phase 2, and once that association has been made phase 1 doesn't matter. Therefore, Phase 1 can show as down and the tunnel will still be perfectly operational.

I would honestly guess here that your issue is more to do with not having a tunnel-monitoring profile assigned to the tunnel, which means the PA might not notice if your ASA closes the tunnel due to inactivity. Which means you kind of have two options:

1) Apply a tunnel monitoring profile so your PA actually knows when the ASA side of the tunnel goes down.

2) Configure the ASA so 'vpn-idle-timeout none' is present within the assigned group-policy attributes.

Re: Phase 1 is down but phase 2 is up- test vpn phase 1 and 2

MP18 — Wed, 30 Jan 2019 04:20:23 GMT

we do not have tunnel monitoring setup as Cisco side is configured for tunnel down after 30 mins idle timeout.

Will ask Vendor to configure the ASA so 'vpn-idle-timeout none