AWS S2S VPNs not re-establishing?

drewdown — Mon, 12 Jul 2021 18:07:35 GMT

Having issues with a fair amount of AWS VPN tunnels that will go down due to path or ISP issues but they don't come back up unless I manually bounce them on the PAN side. Configuration is standard with DPD set to 10/2 and using PBF monitoring the far ends of the tunnels. So I will see the tunnels go down and they show down in AWS but they DO NOT come back up until I manually bounce them from the IPSec Tunnels page.

Has anyone seen this before? I am seeing this across 2 separate PANs (1 x HA, 1 standalone) to separate AWS accounts/regions but the problem seems to be consistent and not sure why.

Note I am not using 'Tunnel Monitor' on the IPSec Tunnels but I am on the PBF rules, could that be the problem? Meaning I should be using TM on one or the other but not both? Someone show me the way.

Re: AWS S2S VPNs not re-establishing?

NathanielM — Wed, 03 Aug 2022 09:15:44 GMT

Not sure if you found a solution to this...

As stated here in the KB article:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVGCA0

My interpretation of reading that means if the tunnel goes down (or presumably being initially set up) it will only be negotiated by interesting traffic, so you have several options to keep that interesting traffic:

Tunnel monitor using your tunnel interface, the route to the peer will be via the tunnel hence it is interesting traffic.
1. On a side note i'd use "path monitoring" instead of PBF if you have two static routes to the same destination. E.g. 10.1.0.0/24 via tunnel 1, 10.1.0.0/24 via tunnel 2. Just put the prefferred metric on 10 and the other 20 and be sure to path monitor on both routes.
If you have a monitoring tool such as Solarwinds ping something on the remote end, even if it is just to a dummy host.
Set up a lambda function to be triggered when the tunnel is down. It will then run the "test" commands on the PA:
1. test vpn ike-sa gateway <gateway_name>
2. test vpn ipsec-sa tunnel <tunnel_name>

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/vpns/set-up-site-to-site-vpn/test-vpn-connectivity

topic AWS S2S VPNs not re-establishing? in General Topics

AWS S2S VPNs not re-establishing?

Re: AWS S2S VPNs not re-establishing?