Intermittent tunnel down between HUB and satellite

Reply
L4 Transporter

Intermittent tunnel down between HUB and satellite

intermittenly we are seeing tunnel go down between HUB and satellite office and getting notification.

GlobalProtect Site to Site Gateway tunnel monitor down.Tunnel monitoring failed on tunnel interface:tunnelXXX to Satellite XXXX due to: Satellite not available


any help with troubleshooting steps would be helpful.

L4 Transporter

Re: Intermittent tunnel down between HUB and satellite

Hello Mandar,

Check the following CLI output:

> show global-protect-satellite current-gateway

It will tell details of tunnel like:

Tunnel Monitor Enabled : Yes

Tunnel Monitor Interval : 3 seconds

Tunnel Monitor Action : fail-over

Tunnel Monitor Threshold : 5 attempts

Tunnel Monitor Source : 10.11.12.12

Tunnel Monitor Destination : 172.16.1.254

Tunnel Monitor Status : Up

Make sure you have proper connectivity between the above source and destination, also if there are any route flaps as you mentioned it is intermittent.

Useful resources you may refer:

Large Scale VPN (LSVPN) Deployment Guide

Useful commands from this doc:

Gateway/Portal

show global-protect-gateway gateway type satellite- To view the gateway configuration summary.

show global-protect-gateway flow-site-to-site- To view the established tunnel state.

show global-protect-gateway flow-site-to-site tunnel-id <number> or show global-protect-gateway flow-site-to-site name

<tunnel name > - To view the established tunnel details. You can view the tunnel-id using the command - show globalprotect-gateway

flow-site-to-site

show global-protect-gateway current-satellite- To view the details of current satellite.

Satellite

request global-protect-satellite get-gateway-config satellite <name> gateway-address <ip_address>- To fetch the

configuration from the gateway if any configuration changes are made to the gateway. By default, the gateway configuration

is refreshed every 2 hrs.

request global-protect-satellite get-portal-config satellite <name>- To fetch the configuration from portal. By default, the

gateway configuration is refreshed every 24 hrs.

test global-protect-satellite gateway-connect gateway-address <IP address> method activation satellite <name>- Trigger

GlobalProtect satellite connects to gateways.

Hope that gives some info.

Regards,

Dileep

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!