IPSec intermittent disconnection issue

[AY_FASAR]

Hi,

Is there a command to check if a tunnel went down on a specific time and why it happened.

I have a tunnel set-up to a 3rd party where they keep monitoring some of their servers. They inform me that they receive alarms every hour that the endpoint is down and its not coming back up for about 15 min.

I cant see anything obvious. I have done show vpn flow name ...  but I cant see any error there. is there any other logs that I could check to see those disconnections that 3rd party mentioning and if I can get any clue from the output why the tunnels going down.

[Brandon_Wertz]

---

@AY_FASAR wrote:

Hi,

Is there a command to check if a tunnel went down on a specific time and why it happened.

I have a tunnel set-up to a 3rd party where they keep monitoring some of their servers. They inform me that they receive alarms every hour that the endpoint is down and its not coming back up for about 15 min.

I cant see anything obvious. I have done show vpn flow name ...  but I cant see any error there. is there any other logs that I could check to see those disconnections that 3rd party mentioning and if I can get any clue from the output why the tunnels going down.

---

If you look in the GUI logs, (system) and filter on type of "VPN" (I think.) that should give you the logs you're looking for.  I would also add time stamps filters with a "geq" (after - greater than equal to) & "leq" (before - less than equal to) for the time period you had VPN issues.  You can look through the logs and find errors much easier that way.

[AY_FASAR]

all I can see is just the key negotiation, nothing else to suggest there is an issue. 3rd party insists that they sent traffic down the tunnel to us and that they get dropped our end. if they keep sending traffic, means the tunnel stays up all the time but there is some other issue.

Could the traffic getting dropped some how during the rekey phase? if there is possibility, is there a debug or packet capture to prove this? with packet capture it might be a bit tricky as the issue is intermittent.

[nohash4u]

@AY_FASAR to clarify your issue - the tunnel states it is up on both ends, but there is no traffic flowing through it? Working through something similar to this myself. 

A few thoughts: 

• Could a Zone Protection Profile be blocking traffic? 
• I believe a packet capture may be best, especially with logging packet-diag features enabled. 
• An easy win - make sure NTP settings are valid on both ends of the tunnel. 
• It could be worthwhile to follow up with the ISP. 
• Is the far end device also a Palo Alto Networks NGFW? 
• Wildcard thought - MTU size? 
• What version of PAN-OS are you running? 

Will keep you updated if I find RCA in my case. 

[AY_FASAR]

I dont believe its NTP or anything similar, all other tunnels working fine. it's only this tunnel's 3rd party and the issue is intermittent.

Not sure what vendor is 3rd party's gateway but I can check.