PA-200 Cable modem VPN sites needing a power cycle to restore connectivity

[MikeJamrog]

I have multiple remote sites that connect back to a main site through PA-200's, using Charter Communications cable modems.  At various times the PA's stop forwarding traffic.  I can no longer reach the PA's and I have setup management on the outside ip addresses.  The only way to recover from this is to have someone at the remote site power cycle the PA's.  Has anyone else run into this issue?  We have a around 30 sites and it is very random.  It almost as if the PA doesn't recover for something going on with the cable modem and just gives up.  I have had Cisco 5505 ASA's prior to the PA's and never had this issue.  

I have worked with PA support, see this thread for some background.

https://live.paloaltonetworks.com/t5/General-Topics/Multiple-PA-200-Firewall-s-lock-up-and-require-a...

[BPry]

It would be interesting to see what your actual cable modem configuration looks like, for example is the device in pass-through mode, DHCP or Static Address, ect. I also didn't see it mentioned anywhere if you are running a split-tunnel or if everything is going through the tunnel. 

One of the things that I would look at is if the show vpn ike-sa gateway <value> or the show vpn ipsec-sa tunnel <value> still shows the connections as active? I'll also pull a Cisco and ask why they are still running  6.1.3, it might be worth upgrading one of them that does this more often to the latest 6.1.*, or 7.0.*, or even 7.1.* if you like to live dangerously. 

[MikeJamrog]

The cable modems are setup statically.  No split tunneling used, everything is going over the vpn tunnel.  I have upgraded a few to the latest code but still having the same issues.

Thanks

[BPry]

In that case I would be intereseted in seeing the response of those two commands that I sent previously. If the firewall that all of these are routed back to is holding onto the old VPN credentials it wouldn't allow the remote firewall to "connect" again because it already is. This would also throw off the routing table which would explain why you can't get to the outside interface for management, with the traffic not being split-tunneled then it would also explain why all the traffic is halting. 

It might help to throw a few of these as a split-tunnel and see if the issue persists, and if it does do they just lose access to internal (VPN Source) resources or does the internet connection drop as a whole.