Site to Site VPN Tunnel is up, but no traffic pass through

[UXPSystems]

Hi all.  I am trying to setup a site to site VPN tunnel with one of our customer.  I've got the dedicated layer 3 zone, tunnel interface, IKE Gateway, Virtual Router etc. configured per the Palo Alto admin guide.  In the "IPSec Tunnels" section, it shows the VPN tunnel is up.  However, I cannot access any of the server located at the customer's environment. 

In the Traffic monitor tab, it shows the traffic is sending over to the customer's network, yet nothing is returning from them (Bytes Send = xxx; Bytes Received = 0; Packet Send = xxx, Packet Received = 0). 

Am I missing something here?

Thank you. 

[UXPSystems]

Hi all.  I don't have access to customer's network, thus no pcacp available from their end.  It is a pain to get a hold of their staff to investigate this issue.  They keep responding they've done the necessary configuration at their end, and from their prespective, this VPN configuration has been completed at their end.  Yet no network traffic coming from their end. 

I've gone over the troubleshooting step as outline here,

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Troubleshoot-IPSec-VPN-connectivity-...

I can see the "Encap Bytes" value keep increasing, while the "Decap Bytes" stays constant.  Per the explaination, that indicate network traffic is going out, but nothing returns from the target. 

[TranceforLife]

I think in this situation you and another end should go for a conference call and get all troubleshooting steps alive rather than do a finger-pointing. Without the other end, it is going to be hard to get this resolved as you can see.

[santonic]

From what you described here i would say that the issue is definitelly on the other side. If you are sending packets into tunnel, they are getting them. Now they must find out what happens with them. And i feel your pain. I've also have many occasions when i was debugging VPN on the other end as well even tho i had contract only with my customer 🙂

One (very unlikely) issue could also be SPI missmatch; exchange info about SPIs with admin on the other end and check if they match. 

I guess on your side you have only 1 pair?

[UXPSystems]

Hi all.  After couple of email exchange with the customer, and conference calls.  It ends up their network administartor configured the VPN tunnel, yet he didn't configure the routes for this VPN connection.  That explains why the tunnel is up, but no traffic goes through.  Now they've assigned another network administrator to look into, yet he is on vacation till mid May....  Nothing can be done till mid May.  Thank you for all the feedback, much appreciated!