PBF and Tunnel monitoring failing

Reply
L2 Linker

PBF and Tunnel monitoring failing

Hello

I have strange intermittant issue with PBF and Tunnel monitoring. If I disable the IPsec VPN at both side and bring it up PBF and Tunnel monitoring is working at configured. ( Shows as up ) I have configured a monitor IP destination of an address across the tunnel. Randomly the PBF and Tunnel monitoring fails. Even thou the IPsec VPN is up. If I use CLI to ping the destination using 'ping source tunnel interface IP host monitor IP ' it passes absolutely fine. If I remove the monitored IP and just keep 'disable this rule if monitor/nexthop ip is unavailable' clicked. The PBF actually is working. System logs do not show it as back up but traffic is being forwarded as per the configuration of the PBF.

I have read both the below articles
https://live.paloaltonetworks.com/t5/Management-Articles/PBF-Rule-is-not-Working-When-PBF-Monitoring...
https://live.paloaltonetworks.com/t5/Configuration-Articles/Understanding-behavior-of-PBF-and-Tunnel...

Any ideas anyone

Thanks in advance

Community Manager

Re: PBF and Tunnel monitoring failing

hi @Nick.Spender

Is there a static route for the monitor ip that ensures packets are sent into the tunnel? monitors can't use pbf to reach their destination

 

did you use a single VR for both VPN tunnels or did you go with the dual-VR design?


Help the community: Like helpful comments and mark solutions
Reaper out
L2 Linker

Re: PBF and Tunnel monitoring failing

@reaper

 

Hello,I hope your well. I went down the 1 VR with Static route path monitoring for 0.0.0.0/0, WAN failover seems to work fine. Yes there is a static route for the tunnel. tunnel interface IP is also included in the proxy ID's in the IPsec config. Same at the other end. 

 

Thank you :)

 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!