IPSec VPN tunnel no longer working

cancel
Showing results for 
Search instead for 
Did you mean: 

IPSec VPN tunnel no longer working

L4 Transporter

Hello guys

We have a few VPN tunnels between our PA-2050 (in HA cluster) and some WatchGuard firewalls (different models). We migrated these tunnels to the PA-2050 a few weeks ago and they ran stable. Now suddenly two of 10 tunnels are down and we don't get them back up.

Here's what we tried so far:

- Rebooting the WatchGuard firewalls

- Suspending the active PA-2050 so the standby HA device takes over

- Removing the VPN config on the WatchGuards and rebuild them (only VPN part)

- Overwrite the PSK on both ends

- On the PA-2050 CLI: clear vpn ike-sa gateway <gw-name> and clear vpn ipsec-sa tunnel <tunnel-name>

- some more small stuff

The config is the same on all tunnels, including the two not working...

PA_Gateway_Settings.png

PA_Tunnel_Settings.png

PA_Logs.png

Any inputs would on how we can further troubleshoot the issue would be much appreciated. The connection by the way is working. We can ping the endpoints mutually and we can also access the external admin interface of the remote WatchGuard firewalls...

Thanks!

Oliver

18 REPLIES 18

Not applicable

Yeah I'll have to see... problem is I can reboot and it just comes back. I will try other methods of clearing out the stale sessions but it's still a problem Palo Alto has to address. When a session ends a tunnel should re-establish and it doesn't, instead it just hangs. Not good. I'll update this thread if I find anything else.

-J

If your side gets this "timeouts" log entries it would be interesting to see what the logs on the other side are (if its possible to get them).

L1 Bithead

For our client problems started with

"Application Identification package upgraded from version 316-1432 to 317-1438 by Auto update agent"

and the ike traffic was sometimes recognized or maybe not recognized as "unknown-udp".

I added a rule with service to allow udp:500 between VPN peers as a quick fix which seems to work so far.


You might also want to verify ike sessions (show session all filter destination-port 500) and do some cleanup if they are in discard state.

We suddenly started getting in the last couple of weeks.  Our VPN had been solid as rock for a few months and then after an issue with the routing along the way (our ISP) the VPN refused to recover unless we rebooted.  It happened again over the weekend.  I am not aware of any issues with the ISP this time however we had to reboot our PA-500 (4.1.5) to get the connection back.

Will see if next time this occurs I can clear out the stale sessions

We noticed that it's somtimes necessary to not only clear the stale session but also to clear the vpn flow of that tunnel:

1. clear session id <value>

2. clear vpn flow tunnel-id <value>

Thank you for that oschuler will try it next time

L4 Transporter

Looks like the latest release (version 318) contains modifications on the 'ike' decoder. We'll install it on Sunday, hopefully the issues are gone with it...

L1 Bithead

OK our VPN is lasting for 28 hours with an 8 hour lifetime.

Having just got it back, it would appear that the UDP packets are not being correctly identified as IKE and being dropped at the firewall. I am guessing this is on a re-negotiation of the link.  I just looked for 318 and there was no sign of it so I will keep an eye on it being available

Not applicable

I haven't had an issue since reverting back to 4.1.4. Perhaps there was just an issue with the install...

When 4.1.7 is released I'll try that along with the 318 content.

-J

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!