IPSEC Tunnel Down, All configuration is okay

[S.Negi324206]

Hi,

I have created a site to site tunnel, both devices are Paloalto firewall; One  Firewall is PA 820 and another one is PA 410

All the configuration is okay but tunnel is down.

We are ping public IP of PA 410 from PA 820, But Not able to ping public IP of PA 820 from PA 410 as ICMP is blocked for PA 820  Public IP.

Please suggest any solution.

[Raido_Rattameister]

Does "test vpn ipsec-sa tunnel <name>" from firewall cli bring up the tunnel?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC

[S.Negi324206]

Already tried this command but still tunnel down.

[Raido_Rattameister]

Logs on initiator side show only if it times out.

You need to check logs on destination side as only destination shows details if there is config mismatch.