04-09-2017 12:03 AM
Hi Guys,
Got a quick query. We have implemetmented new pa 3050 firewall in our perimeter. Two IPSEC vpns configured and working fine. We notice, after couple of hours, the Status of first led goes red. but, the second status led stays green. During this time remote end complained that they cannot transfer file. Once we issue the following command on the firewall the vpn comes up and the issue getting resolved.
clear vpn ike-sa gateway
clear vpn ipsec-sa tunnel
test vpn ike-sa gateway
test vpn ipsec-sa tunnel
everyday we are facing this issue.
Is their any way we can keep the tunnel up always?
04-09-2017 03:12 AM - edited 04-09-2017 03:13 AM
Hi,
This is what l get from time to time in the IPSec Tunnel status tab but my tunnel traffic flow still ok as my Phase 2 (actual IPSec tunnel) still up.
If your IPSec tunnel is not renegotiating automatically, best start with ikemgr.logs:
> tail lines 50 mp-log ikemgr.log
04-09-2017 03:34 AM
Is their any way we can keep the tunnel up always?
this is done through tunnel monitoring.
https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/vpns/set-up-tunnel-monitoring
10-01-2018 08:17 PM
What about if I'm seeing this with both LEDs red ? IPSEC and IKE down..
Yet to see ikemgr.logs..
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
