Palo Alto Site to Site IPsec VPN went down

[EvanRaci]

Hi ,

We've setup Site to Site IPsec VPN between Palo Alto Firewalls. The tunnel was up and working but it went down after some time.

Look like the tunnel went down because there is no traffic passing through the tunnel. Everytime we need to trigger IPsec tunnel by using >test vpn ike-sa gateway to bring up.

How can we configure the tunnel to be up all the time even there is no traffic passing through the tunnel?

Do we need to enable tunnel-monitor ? Are there any other ways to make the tunnel up all the time?

We are using IKEv2 preferred mode and we already enabled DPD for Ikev1 and liveliness check for ikev2.

Please help suggest.

[Raido_Rattameister]

Either tunnel monitor or path monitoring inside virtual router.

Without them tunnel will not be renegotiated if no interesting traffic.

[EvanRaci]

After Checking Config , the issue is DH value mismatch. Change both side to same DH Value and now working fine