IPSEC VPN IKE Phase 1 Goes down after couple of hours

[irshad.n]

Hi Guys,

Got a quick query. We have implemetmented new pa 3050 firewall in our perimeter. Two IPSEC vpns configured and working fine. We notice, after couple of hours, the Status of first led goes red. but, the second status led stays green. During this time remote end complained that they cannot transfer file. Once we issue the following command on the firewall the vpn comes up and the issue getting resolved.

clear vpn ike-sa gateway 

clear vpn ipsec-sa tunnel  

test vpn ike-sa gateway 

test vpn ipsec-sa tunnel   

everyday we are facing this issue.

Is their any way we can keep the tunnel up always?

[TranceforLife]

Hi,

This is what l get from time to time in the IPSec Tunnel status tab but my tunnel traffic flow still ok as my Phase 2 (actual IPSec tunnel) still up.

If your IPSec tunnel is not renegotiating automatically, best start with ikemgr.logs:

> tail lines 50 mp-log ikemgr.log

[bradk14]

---

Is their any way we can keep the tunnel up always?

---

this is done through tunnel monitoring.

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/vpns/set-up-tunnel-monitoring

[mpgioia]

What about if I'm seeing this with both LEDs red ?  IPSEC and IKE down..

Yet to see ikemgr.logs..