topic Re: IPsec VPN tunnel cant ping eachother in General Topics

IPsec VPN tunnel cant ping eachother

pkathiria — Thu, 31 Oct 2019 17:53:15 GMT

Hi there,

I cant figure it out why tunnel interface cant ping each other even site to site VPN is up and running fine. Is there anything I am missing here?? I have setup multiple site to site VPN with all other vendor and its just works fine. This is to Palo to Palo.

i did test vpn ike-sa and ipsec-sa multiple time but still no luck

Thanks in advance.

Pratik

Re: IPsec VPN tunnel cant ping eachother

BPry — Thu, 31 Oct 2019 21:44:23 GMT

@pkathiria,

Just something to verify quick, do you actually have a managmenet profile assigned to the tunnel interface that allows ping?

Re: IPsec VPN tunnel cant ping eachother

mrajdev — Thu, 31 Oct 2019 21:50:21 GMT

Also check the VPN flow on both sides when you do a ping to check the encap/decap counters. This will help you find out which peer to focus on.

Also setup a packet-filter and use the command "show counter global filter packet-filter yes delta yes" do this command multiple times and look for drops.

Hope the above helps.

Thanks

Re: IPsec VPN tunnel cant ping eachother

pkathiria — Fri, 01 Nov 2019 18:29:57 GMT

@mrajdevwe found the issue. The packet is no decapping on other side but we don't know how to fix that also Support team is also working on it. we tried every possibility but no luck. have you ever experience this issue before?? do you know the fix for this ??

Thanks in advance.

Re: IPsec VPN tunnel cant ping eachother

KaloyanKirchev — Thu, 19 Mar 2020 07:57:28 GMT

Hello @pkathiria ,

Do you have resolution to this. I have similar issue. BUT through IPSEC I can ping printers and some servers. I cannot ping workstations.

I know this little old but any help will be highly appreciated.