topic Re: IPSEC VPN - Cannot ping across the tunnel. Both Ph1 and Ph2 tunnels are in General Topics

IPSEC VPN - Cannot ping across the tunnel. Both Ph1 and Ph2 tunnels are up.

Rutvij — Mon, 12 Oct 2020 23:10:53 GMT

Hi All,

I have set up an IPSec VPN tunnel which seem to be up, however, i cannot ping from my local LAN IP on tunnel interface to the other side LAN interface of the tunnel. NOTE - Other end of the tunnel is terminated on ISP network where we are using their MPLS network to connect our global sites.

My side palo alto firewall has tunnel.11 interface with 10.10.8.17/30 ip address and the other end at ISP has been configured with 10.10.8.18/30

rutvijb@pa-fw(active)> ping source 10.10.8.17 count 5 host 10.10.8.18
PING 10.10.8.18 (10.10.8.18) from 10.10.8.17 : 56(84) bytes of data.

--- 10.10.8.18 ping statistics ---
5 packets transmitted, 0 received, 100% packet loss, time 4010ms

Re: IPSEC VPN - Cannot ping across the tunnel. Both Ph1 and Ph2 tunnels are

BPry — Tue, 13 Oct 2020 00:26:24 GMT

@Rutvij,

Do you have a route configured for the traffic? Do you have an interface management profile assigned to the interface on each device that actually allows ICMP/Ping?

Re: IPSEC VPN - Cannot ping across the tunnel. Both Ph1 and Ph2 tunnels are

Rutvij — Tue, 13 Oct 2020 01:32:05 GMT

Hi BPry - Yes I have static routing configured as well as management profile assigned on our side. I am not sure what Vendor side is configured with but they are saying it looks all good on their side.

Re: IPSEC VPN - Cannot ping across the tunnel. Both Ph1 and Ph2 tunnels are

BPry — Tue, 13 Oct 2020 02:07:02 GMT

@Rutvij,

So I hate to blame it on the other side, but this configuration is relatively straight forward. Configure the IP address on the tunnel interface, configure the routing, verify that the security rulebase is properly permitting the traffic, and lastly verify that the tunnel interface accepts ping from the IP address that you are testing from.

I would just verify with the folks running the other device that they've actually verified the security rulebase on their end is allowing the traffic, that the interface-management-profile actually allows ping, and that they haven't configured permitted IPs on that interface-management-profile.

As long as that all looks good on both sides, this really should "just work" from a configuration standpoint.