GRE Tunnel

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

GRE Tunnel

L1 Bithead

Hi,

I've been trying to create GRE Tunnels to connect with Zscaler. It works and I can see traffic flow through but the tunnels keep going down after about 5 minutes. What should I be watching out for?

Thanks!

5 REPLIES 5

Cyber Elite
Cyber Elite

Thank you for the post @smshafek

 

could you confirm what error it throws on Zscaler side when it goes down? Navigate to: ZIA > Analytics > Tunnel Insights > Logs, then check Tunnel Status and Event Reason (Make sure that these options are enabled in view): 

 

PavelK_0-1654903706173.png

Have you enabled GRE keepalive in Palo Alto side?

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

L1 Bithead

Hi @PavelK 

it shows for both tunnel status and event reason none and none. 

Yes, I have enabled GRE keepalive in Palo Alto. I've created two tunnel interfaces, set up the GRE Tunnels for the two interfaces, enabled NAT and policy based forwarding. Do I have to add a next hop in the policy based forwarding? And which IP Address should I enter for tunnel monitoring?

Thanks!

Cyber Elite
Cyber Elite

Thank you for reply @smshafek

 

if it shows "none" in the Insights Logs, then there is no way to drill down more details from Zscaler portal. The official answer from Zscaler is to open a support ticket and troubleshoot it in real time with support staff.

 

Would it be possible to check system logs on Palo Alto side: (subtype eq gre) ?

 

Regarding your question, from my point of view since GRE tunnel is point to point, it is not must to add next hop along with egress interface, however a sample configuration from Zscaler has next hop set: https://community.zscaler.com/t/gre-tunnel-from-palo-alto-firewall/8024/2 so it will not hurt to add it to PBF. Regarding the monitoring, I would target the next hop IP address (Internal ZIA Public Service Edge IP).

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

L1 Bithead

Hi Pavel,

it shows in the system logs critical and "Tunnel GRE-ZSC is going down" for both tunnels. I've also configured policy based forwarding and in the system logs it shows "Vsys 1 PBF rule GRE-ZSC nexthop is going down".

I'm not sure how I should continue with troubleshooting from here.

Thanks again!


Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!