IPSEC VPN Tunnel Problem

[almay]

PAN PA2020 PAN OS 4.16

I have a point to point vpn setup from our company to another company that is hosting our financial application.

We have 10 different proxy IDs setup to limit subnet's that can access the vpn for example:

Almost everyday, all proxy ids can access the vpn tunnel with the exception of proxy id 2 or proxy id 3.

Any thoughts?

Thank you in advance...

[gfowler]

What is the device on the other side of the VPN?

Do you see any errors in the system log?  Monitor / Logs / System?

If the remote side is a CheckPoint, then it may be joining 192.168.2.0/24 and 192.168.3.0/24 into a larger subnet, 192.168.2.0/23.

--- UPDATE:

I tested this in my lab.  The PAN with report the proxy IDs using during phase 2, even when the negotiation fails.  This makes it much easier to determine if the other side has fat fingered a encryption domain / crypto-map ACL

Such a beautiful device.

[UhMayYeah]

a> Check if the routes have been configured pointing to the tunnel interface.

b>Security rules allowing traffic between the inside and tunnel zone.

Also check if the peer device has a rule allowing this traffic.

Check traffic logs filtering the source and dest, include  the columns bytes sent and received to see if PA is dropping the traffic or if we are not getting responses.

-Ameya