Site-To-Site VPN to VMWare VShield Edge?

[jsalmans]

Greetings all.

We're in pre-deployment for our firewall and I'm attempting to get an Site-To-Site VPN tunnel set up to our VShield Edge setup in the cloud.  I have a tunnel established but we can't seem to get anything across it.

Troubleshooting so far:

• Verified on the Traffic Monitor I can see my pings going from my inside trusted zone to our Site-To-Site VPN zone and that they're getting aged-out session ends.
• "show vpn flow" is showing encap bytes increasing with no change in decap bytes which should mean I'm sending but I'm not receiving from the other side
• I have an Interzone allow for any application with both my inside trusted zone and Site-to-Site zone added to the source and destinations
• I created a NAT rule to set No-NAT for anything coming from my inside trusted zone to the host on the other side I'm trying to ping

We have a connection from our existing Cisco ASA to the VShield Edge setup that works and we're able to ping and pass traffic.  That setup has Reverse Route Injection configured.  The VShield Edge has no static routes configured (for the ASA VPN either) and it's interface is rather limited... apparently we don't have the Advanced Networking license.

Anyone have any ideas or have any experience with this?

Thanks!

[Transporter]

Halo,

Article below will help you to troubleshoot:

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Troubleshoot-IPSec-VPN-connectivity-...

Cheers 

[jsalmans · Accepted solution]

The issue ended up being with the Tunnel Monitor I had set up.  One of the PA techs got me a link to this article:

https://live.paloaltonetworks.com/t5/Configuration-Articles/Tunnel-Monitoring-for-VPN-between-PA-and...

I hadn't realized the monitoring packets are sent out every SA and not only the one that the target host falls in.  If any of those don't receive a response back (I'm assuming a "Host not reachable" would even suffice) due to a packet drop, then the tunnel monitor fails and starts trying to re-key constantly.

If tunnel monitors could be configured per SA or an SA selected to use for the one tunnel monitor then this could still work the way I was thinking but, the current software only has the one tunnel monitor that sends packets to the destination IP over every SA.

Our solution is going to be just to use the Dead Peer Detection with the IKE Gateway since the tunnel doesn't require any extrodinary measures to make sure it is up 100% of the time.