Intermittent tunnel down between HUB and satellite

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Intermittent tunnel down between HUB and satellite

L4 Transporter

intermittenly we are seeing tunnel go down between HUB and satellite office and getting notification.

GlobalProtect Site to Site Gateway tunnel monitor down.Tunnel monitoring failed on tunnel interface:tunnelXXX to Satellite XXXX due to: Satellite not available

any help with troubleshooting steps would be helpful.

SD-WAN | Cloud Networking | PCNSE | ICSI CNSS | MCNA | | CCNP | CCSA | SPSP | SPSX | F5-101 |

L4 Transporter

Hello Mandar,

Check the following CLI output:

> show global-protect-satellite current-gateway

It will tell details of tunnel like:

Tunnel Monitor Enabled : Yes

Tunnel Monitor Interval : 3 seconds

Tunnel Monitor Action : fail-over

Tunnel Monitor Threshold : 5 attempts

Tunnel Monitor Source :

Tunnel Monitor Destination :

Tunnel Monitor Status : Up

Make sure you have proper connectivity between the above source and destination, also if there are any route flaps as you mentioned it is intermittent.

Useful resources you may refer:

Large Scale VPN (LSVPN) Deployment Guide

Useful commands from this doc:


show global-protect-gateway gateway type satellite- To view the gateway configuration summary.

show global-protect-gateway flow-site-to-site- To view the established tunnel state.

show global-protect-gateway flow-site-to-site tunnel-id <number> or show global-protect-gateway flow-site-to-site name

<tunnel name > - To view the established tunnel details. You can view the tunnel-id using the command - show globalprotect-gateway


show global-protect-gateway current-satellite- To view the details of current satellite.


request global-protect-satellite get-gateway-config satellite <name> gateway-address <ip_address>- To fetch the

configuration from the gateway if any configuration changes are made to the gateway. By default, the gateway configuration

is refreshed every 2 hrs.

request global-protect-satellite get-portal-config satellite <name>- To fetch the configuration from portal. By default, the

gateway configuration is refreshed every 24 hrs.

test global-protect-satellite gateway-connect gateway-address <IP address> method activation satellite <name>- Trigger

GlobalProtect satellite connects to gateways.

Hope that gives some info.



  • 1 replies
  • 101 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!