Ipsec down after enabled tunnel monitor

[Ahmad_ElKilany]

I have tunnel ipsec site to site vpn after enabling tunnel monitor tunnel status is down although phase 1 and phase 2 are up.

Version 9.0.9-h1

[Thyrion]

if both phases are still showing green ,the tunnel is actually up

how did you set the monitoring profile? have you tested pinging the remote IP for reachability before enabling tunnel monitoring?

double check if your security policy allows pinging the remote IP, double check if there is a need for additional routes or proxy-IDs for the remote IP, check if the IP is accepting ping (it may require a profile to be activated, or an ACL/security policy to be updated before you are able to ping it

[MoatasemMetwaly]

@Thyrion Thanks for your reply

for the monitoring profile it configured as fail over

and we can reach the pear tunnel IP before enable tunnel monitor 

and there is a policy to allow ping 

but after enable  tunnel monitor  the status goes down with no reason

and when we try to ping the peer tunnel IP in this time the reply is Destination Host Unreachable

[Thyrion]

The 'fail-over' action will bring down the tunnel when the remote peer is unavailable

Do you have a backup tunnel to take over? If not, it is better to hold-wait, else the tunnel has no way of recovering from a fault

Hold-wait will also allow you to troubleshoot your tunnel monitor as it will not kill the tunnel

[Ahmad_ElKilany]

yes, I have a backup but I reach the peer when I disable the monitor when I enable it the peer is unreachable.

when I enable monitor, the peer unreachable but phase 1&2 green.