IPsec tunnel connectivity issues

[Akhil_B]

Hi, I have an IPsec Tunnel between 2 PA's and the status of tunnel and iKE shows red but the interface is green. Please advice on the troubleshooting steps.

[OtakarKlier]

Hello,

If the status of the tunnel is red, then it is not established. Check the System logs to see if there are any errors relating to the IKE or IPSec. Also here is a link I of things I typically use to troubleshoot tunnels.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC

Regards,

[nikoolayy1]

Also check the system logs from the firewall that is a responder or just make one the responder and then check from it:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClMZCA0

If th system logs don't help then enable pcap on the ike process. If the pcap is empty eiither the security policy blocks the ike or the packets don't reach the palo alto devices, so check the network between them.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC

[aleksandar.astardzhiev]

Hi @Akhil_B ,

Interface status (the icon in the very right) is showing the status of the logical tunnel interface associated with that IPsec VPN. This tunnel is logical (something like loopback interface) it will never go done by itself.

The other two icons (green/red dots) are representing the actual IPsec Phase1 and Phase2 status.

So if you see any of the dots red this means that this phase failed to negotiate.

Going back to the interface status. In short you can completely ignore this status unless you are using tunnel monitor. Without tunnel monitor the tunnel interface will always be up. Tunnel monitor is a feature which will "shutdown" the tunnel interface if it detects issue with the tunnel.