If the initiator is the Palo Alto Networks firewall, you can bring the tunnel up with a test from the CLI like:
> test vpn ike-sa gateway <gateway_name> (will bring Phase 1 up)
> test vpn ipsec-sa tunnel <tunnel_name> (will bring Phase 2 up)
Here is what I am seeing when the tunnel is up
gateway id: 5
local ip: 184.108.40.206
peer ip: 220.127.116.11
inner interface: tunnel.5
outer interface: ethernet1/3
tunnel mtu: 1428
lifetime remain: 20799 sec
latest rekey: 8001 seconds ago
monitor packets seen: 0
monitor packets reply: 0
en/decap context: 100
local spi: B1874737
remote spi: CB7EC37F
key type: auto key
auth algorithm: SHA1
enc algorithm: AES256
proxy-id local ip: 10.135.100.0/24
proxy-id remote ip: 10.135.11.0/25
proxy-id protocol: 0
proxy-id local port: 0
proxy-id remote port: 0
anti replay check: yes
copy tos: no
authentication errors: 0
decryption errors: 0
inner packet warnings: 0
replay packets: 0
when lifetime expired:0
when lifesize expired:0
sending sequence: 212815
receive sequence: 200841
You said you're connecting the PA to an ASA? I would only recommend this for troubleshooting, but have you tried aggressive mode? When I used to work with ASAs, once upon a time, I found that different vendors didn't play well with ASAs (or vice versa, however you choose to look at it). I had to use aggressive mode. Which I don't recommend btw because they are less secure because plain text is used and reveals data about the endpoints. I'd say it's worth a shot though to see if that stabilizes the tunnel. Just a thought. Do you have other tunnels connecting to ASAs or just this one?
Correct the other tunnels I have are also connectingfrom PA to ASA 5505 and using main mode. I have not used aggressive mode for the reason you just stated. It appears to be a very regular pattern of going off in the afternoon and back on the next day.
Under system logs, search using the filter "( subtype eq vpn )". I'm not sure what event you would be searching for but this should be a good start. Using this filter and searching during the time it goes down should help you find what you are looking for. Good luck!
I think this is when it is succeeding
and ( description contains 'IKE phase-2 negotiation is succeeded as responder, quick mode. Established SA: 18.104.22.168-22.214.171.124 message id:0x1D8ADE40, SPI:0xB1874737/0xCB7EC37F.' )
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!