01-16-2015 03:22 AM
intermittenly we are seeing tunnel go down between HUB and satellite office and getting notification.
GlobalProtect Site to Site Gateway tunnel monitor down.Tunnel monitoring failed on tunnel interface:tunnelXXX to Satellite XXXX due to: Satellite not available
any help with troubleshooting steps would be helpful.
01-16-2015 04:17 AM
Hello Mandar,
Check the following CLI output:
> show global-protect-satellite current-gateway
It will tell details of tunnel like:
Tunnel Monitor Enabled : Yes
Tunnel Monitor Interval : 3 seconds
Tunnel Monitor Action : fail-over
Tunnel Monitor Threshold : 5 attempts
Tunnel Monitor Source : 10.11.12.12
Tunnel Monitor Destination : 172.16.1.254
Tunnel Monitor Status : Up
Make sure you have proper connectivity between the above source and destination, also if there are any route flaps as you mentioned it is intermittent.
Useful resources you may refer:
Large Scale VPN (LSVPN) Deployment Guide
Useful commands from this doc:
Gateway/Portal
show global-protect-gateway gateway type satellite- To view the gateway configuration summary.
show global-protect-gateway flow-site-to-site- To view the established tunnel state.
show global-protect-gateway flow-site-to-site tunnel-id <number> or show global-protect-gateway flow-site-to-site name
<tunnel name > - To view the established tunnel details. You can view the tunnel-id using the command - show globalprotect-gateway
flow-site-to-site
show global-protect-gateway current-satellite- To view the details of current satellite.
Satellite
request global-protect-satellite get-gateway-config satellite <name> gateway-address <ip_address>- To fetch the
configuration from the gateway if any configuration changes are made to the gateway. By default, the gateway configuration
is refreshed every 2 hrs.
request global-protect-satellite get-portal-config satellite <name>- To fetch the configuration from portal. By default, the
gateway configuration is refreshed every 24 hrs.
test global-protect-satellite gateway-connect gateway-address <IP address> method activation satellite <name>- Trigger
GlobalProtect satellite connects to gateways.
Hope that gives some info.
Regards,
Dileep
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
