PBF and Tunnel monitoring failing

[Nick.Spender]

Hello

I have strange intermittant issue with PBF and Tunnel monitoring. If I disable the IPsec VPN at both side and bring it up PBF and Tunnel monitoring is working at configured. ( Shows as up ) I have configured a monitor IP destination of an address across the tunnel. Randomly the PBF and Tunnel monitoring fails. Even thou the IPsec VPN is up. If I use CLI to ping the destination using 'ping source tunnel interface IP host monitor IP ' it passes absolutely fine. If I remove the monitored IP and just keep 'disable this rule if monitor/nexthop ip is unavailable' clicked. The PBF actually is working. System logs do not show it as back up but traffic is being forwarded as per the configuration of the PBF.

I have read both the below articles
https://live.paloaltonetworks.com/t5/Management-Articles/PBF-Rule-is-not-Working-When-PBF-Monitoring...
https://live.paloaltonetworks.com/t5/Configuration-Articles/Understanding-behavior-of-PBF-and-Tunnel...

Any ideas anyone

Thanks in advance

[reaper]

hi @Nick.Spender

Is there a static route for the monitor ip that ensures packets are sent into the tunnel? monitors can't use pbf to reach their destination

did you use a single VR for both VPN tunnels or did you go with the dual-VR design?

[Nick.Spender]

@reaper

Hello,I hope your well. I went down the 1 VR with Static route path monitoring for 0.0.0.0/0, WAN failover seems to work fine. Yes there is a static route for the tunnel. tunnel interface IP is also included in the proxy ID's in the IPsec config. Same at the other end. 

Thank you 🙂