Ikev2 site to site VPN between Arista ETM and Palo Alto

[msdphi]

Hello Mams and Sirs,

I need your advice here.

I have configured an ikev2 policy based site to site VPN between our Palo Alto and client Arista ETM. I manage the Palo Alto.

The status of the VPN shows up. But, communication between the subnets(local and remote) stop abruptly until, I generate some traffic by pinging each of their VLANs/subnets from our server.

All the parameters look correct on both sides.

What I observed is that continuous pings from the Palo Alto side keep the communication up.

Is this a normal behaviour or does any change have to be made on either device? Please help.

[kiwi]

Hi @msdphi ,

Yes, IPSec tunnel comes up only when there is an interesting traffic destined to the tunnel. 

Check the bullet "Interesting Traffic or On-Demand" on this page which explains:

https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/ipsec-vpn-basics/ipsec-v...

To provide uninterrupted VPN service, you can use the Dead Peer Detection capability along with the tunnel monitoring capability on the firewall:

https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/set-up-tunnel-monitoring

Hope this helps,

-Kim.

[msdphi]

Thank you, Kim.

I already have liveliness check enabled and tunnel monitoring won't be possible. Because the client has multiple VLANs. But, configure multiple monitoring IP address is not possible.

I may be wrong. Please advise.

[kiwi]

Hi @msdphi ,

Correct, tunnel monitoring only allows you to monitor one IP.

Why would you monitor more ? For Tunnel monitoring you usually monitor an IP closest to the tunnel IP.

If you want to check on different VLANs being available I think you should look into path monitoring instead.

Kind regards,

-Kim.

[msdphi]

Why would you monitor more ? For Tunnel monitoring you usually monitor an IP closest to the tunnel IP--- so, the problem is that unless I keep continuous pings going to each of their LAN gateways, the communication stops, though the vpn shows as up. But that's not a good solution. I thought we might phase 2 parameters  there 

If you want to check on different VLANs being available I think you should look into path monitoring instead.--- okay will check ..