Always-UP IPsec

[aabozaid]

The ipsec-tunnel comes up only when there is interesting traffic destined to the tunnel or when the tunnel manually initiated.

That leads to problems in our monitoring. I'd like to ask if there is a workaround to make the VPN always-up without need to enable tunnel monitoring. Because tunnel-monitoring must verify connectivity to an IP address from the other side to determine if the tunnel is still usable. That means this IP must be reachable and allowed on the firewall from the other side.

@sduewel @dsegert

[SCantwell_IM]

Hello

The tunnel monitoring was developed to keep the tunnel up by pinging an IP on the remote side.  I do not understand your request for a workaround on a solution that was put into place, for the specific requirement you asked about.

[RamprakashRT]

Hi @aabozaid 

1)Assign an IP address to the tunnel interface ( an IP from the local or trust  subnet of  PA )

2) Create a Dummy pbf like source Trust zone source address any IP , destination 169.254.16.17 with monitoring enabled and monitor an IP address from the remote subnet 

It s not mandatory that remote IP should respond to ping.

Expected result .

Pbf with monitoring always initiate a ping traffic through the tunnel resulting your tunnel will be always up.

Thanks,

Ram

[reaper]

you can set up a ping on any internal host that continuously pings through the tunnel, but setting up tunnel monitor will be much more reliable