topic Re: AWS VPN Tunnel and Path Monitoring in General Topics

AWS VPN Tunnel and Path Monitoring

eridavis — Tue, 30 Jun 2020 15:07:18 GMT

I have 2 AWS instances(Prod and Stage) each with redundant VPN tunnels to the same remote end Palo. I setup path monitoring for each so that when one tunnel is down, the route is removed and the backup route is put in the FIB. This only works with our stage instance and not our prod instance. In each case, the tunnel state on the AWS side does not reflect the fact that I brought the tunnel down on the Palo side. We also have seen times when the AWS tunnel was down, but the Palo side showed the tunnel as up. Has anyone seen this or is anyone using AWS with VPN to Palos and have failover working properly?

Re: AWS VPN Tunnel and Path Monitoring

BPry — Tue, 30 Jun 2020 17:06:34 GMT

@eridavis,

What is your ping interval and count set to, along with your preemptive hold value? What version of PAN-OS are you running?

This should just work, regardless if you VM-Series is running in AWS, Azure, or ESXi there really isn't anything special to the configuration due to hypervisor being utilized. The tunnels will likely show as up unless you've setup tunnel-monitoring so the actual tunnels are checking status; you're kind of already doing that with the path-monitoring on the static routes, but that doesn't really do anything as far as the actual tunnel itself is concerned.

Re: AWS VPN Tunnel and Path Monitoring

eridavis — Tue, 30 Jun 2020 17:17:57 GMT

@BPry Interval is default of 3 seconds and hold is default of 2 mins. Pan-OS 8.1.11. To clarify, we only have Palo at one end. WE are using AWS VPV/VPN natively on the AWS side. The issue is that in our Prod instance the VPN failover is not working. I manually shutdown the primary IPsec tunnel and the path monitor removes the active route properly and adds the backup route to the FIB as it should. The path monitor shows the tunnel is down and the traffic leaves the 2nd tunnel interface but no traffic comes back. Also, the AWS side does not show the tunnel being down in either the prod or stage instances, so I'm not sure how AWS is routing traffic over the tunnels.

Re: AWS VPN Tunnel and Path Monitoring

OtakarKlier — Tue, 30 Jun 2020 18:27:20 GMT

Hello,

This could be a config issue on the AWS side? I would double check both sides to make sure the proper settings are configured.

Regards,