05-15-2023 01:13 AM
I am facing a strange issue with IPSec tunnels built on Palo Alto firewalls.
1. On both ends we have Palo Alto firewalls(various models PA-220, PA440, PA-3220, PA-VM(AWS))
2. Public IP addresses of both ends are always reachable.
3. Tunnel lights always look GREEN.
4. Routing also is in place, either with Static or OSPF routes.
Once tunnel is brought up with 'test vpn' command on CLI, connectivity gets established. However, after few minutes(5 to 10), connectivity automatically breaks and tunnel lights on firewalls on both ends are GREEN.
- With various PAN-OS 10.x.x, no help.
- With various hardware and VM, no help.
- By changing routing protocols, no help.
- With and without assigning IP address to tunnel interfaces, but no help.
Please let me know if you have seen this issue or any guidance would be helpful.
05-25-2023 03:48 PM
It sounds like the test vpn cli command is enough to get P1 and P2 up, but without active traffic on it, is a security feature to down the VPN (but interfaces may still show green)
Suggestion is to setup tunnel monitoring, to ping a destination IP, to keep the tunnel up.
What other questions can we answer for you?
05-26-2023 06:48 AM
Yeah, this is a work around I agree. But this is not an actual fix.
05-26-2023 06:55 AM
Are you saying that test vpn brings tunnel up but generating interesting traffic does not (pinging across the tunnel to other side for example)?
What do you see in traffic log if you ping. Is traffic destination correct tunnel interface?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!