IPSEC VPN - Cannot ping across the tunnel. Both Ph1 and Ph2 tunnels are up.

Showing results for 
Show  only  | Search instead for 
Did you mean: 

IPSEC VPN - Cannot ping across the tunnel. Both Ph1 and Ph2 tunnels are up.

L0 Member

Hi All,


I have set up an IPSec VPN tunnel which seem to be up, however, i cannot ping from my local LAN IP on tunnel interface to the other side LAN interface of the tunnel. NOTE - Other end of the tunnel is terminated on ISP network where we are using their MPLS network to connect our global sites.


My side palo alto firewall has tunnel.11 interface with ip address and the other end at ISP has been configured with


rutvijb@pa-fw(active)> ping source count 5 host
PING ( from : 56(84) bytes of data.

--- ping statistics ---
5 packets transmitted, 0 received, 100% packet loss, time 4010ms


Cyber Elite
Cyber Elite


Do you have a route configured for the traffic? Do you have an interface management profile assigned to the interface on each device that actually allows ICMP/Ping? 

Hi BPry - Yes I have static routing configured as well as management profile assigned on our side. I am not sure what Vendor side is configured with but they are saying it looks all good on their side.


So I hate to blame it on the other side, but this configuration is relatively straight forward. Configure the IP address on the tunnel interface, configure the routing, verify that the security rulebase is properly permitting the traffic, and lastly verify that the tunnel interface accepts ping from the IP address that you are testing from.

I would just verify with the folks running the other device that they've actually verified the security rulebase on their end is allowing the traffic, that the interface-management-profile actually allows ping, and that they haven't configured permitted IPs on that interface-management-profile. 

As long as that all looks good on both sides, this really should "just work" from a configuration standpoint. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!