IPSec Tunnel goes Down After Few Minutes

[raghavendra.badiger]

hi All,

I am facing a strange issue with IPSec tunnels built on Palo Alto firewalls.

Scenario:

1. On both ends we have Palo Alto firewalls(various models PA-220, PA440, PA-3220, PA-VM(AWS))

2. Public IP addresses of both ends are always reachable.

3. Tunnel lights always look GREEN.

4. Routing also is in place, either with Static or OSPF routes.

Issue seen:

Once tunnel is brought up with 'test vpn' command on CLI, connectivity gets established. However, after few minutes(5 to 10), connectivity automatically breaks and tunnel lights on firewalls on both ends are GREEN.

I tried:

- With various PAN-OS 10.x.x, no help.

- With various hardware and VM, no help.

- By changing routing protocols, no help.

- With and without assigning IP address to tunnel interfaces, but no help.

Please let me know if you have seen this issue or any guidance would be helpful.

[S.Cantwell]

It sounds like the test vpn cli command is enough to get P1 and P2 up, but without active traffic on it, is a security feature to down the VPN (but interfaces may still show green)

Suggestion is to setup tunnel monitoring, to ping a destination IP, to keep the tunnel up.

What other questions can we answer for you?

[raghavendra.badiger]

Yeah, this is a work around I agree. But this is not an actual fix.

[Raido_Rattameister]

Are you saying that test vpn brings tunnel up but generating interesting traffic does not (pinging across the tunnel to other side for example)?

What do you see in traffic log if you ping. Is traffic destination correct tunnel interface?