Tunnel Monitor with AWS

[SoftMochi]

Hello Everyone

Does Tunnel monitor work PA - AWS IPSec ?

I've heard it will not work, only PA - PA Connection

I'd appreciate it if you could help me !

Thanks !

[BPry]

@SoftMochi,

The tunnel monitoring feature itself will work perfectly fine, it's just using ICMP to monitor the given host. While PAN technically considers it to be a "proprietary" feature, it works with any ICMP enabled host regardless of what the tunnel peer is. 

[SoftMochi]

Thank you for reply 🙂

then, I have one question

In this picture, as you can see, tunnel monitor is down now

so can I understand peer is not allow icmp now ?

[BPry]

@SoftMochi,

It means that the tunnel IP (used by default with tunnel monitoring) can't send/receive ICMP traffic to the specified tunnel monitoring host. Sometimes you'll see people create a tunnel interface without assigning an IP, but one is required for tunnel monitoring to function. 

[SoftMochi]

So,

1. Make the tunnel interface and tunnel IP

2. Allow ICMP at tunnel interface

3. Config tunnel monitor destination ip(Network -> IPSec Tunnels)

Is it right ?

I'm sorry for bother you ...

Thanks