VPN Phase 2 Tunnel stuck

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

VPN Phase 2 Tunnel stuck

L0 Member

Hi,

We have multiple S2S VPN with many vendors but facing issue with Fortinet. 

 

On our side we observe Phase 2 tunnel is up and packets are going out through Tunnel interface but no reply. Other party saying no issue on their end but once we restart that Phase 2 Proxy id, it starts working.

Just to inform you that we have multiple Proxy ids. all Proxy ids Tunnels comes up different time and face issue at different time so need to restart only that proxy id tunnel.

Kindly let me know how to troubleshoot it either issue is at our end or their end.

3 REPLIES 3

Cyber Elite
Cyber Elite

Just make your Palo Alto the VPN responder so you can see more details in the GUI System logs:

 

How to make Palo Alto Networks firewalls Responder-only in an IPSec tunnel

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClMZCA0

 

 

Also maybe the other  firewall is using policy based VPN:

 

Proxy-ID for VPNs Between Palo Alto Networks and Firewalls with Policy-based VPNs

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClW8CAK

L2 Linker

Hi @ISG-JHAH 

 

Are you checking the status of the IPSec from GUI? The status of the Phase-2 will stay UP (Green on GUI) as long as even 1 proxy ID is UP among all in Phase-2 tunnels.
Please check if the status of the proxy-ID is indeed UP? To check the status, run the below command from the CLI.

 

show vpn tunnel name <name-of-proxy-id>
You will get information like LOCAL PROXY ID, REMOTE PROXY ID, ports etc in output.

 

The VPN logs generated as responder gives more information as suggested by
You can review the system logs and ikemgr logs, during the issue time frame.

 

You can also refer to the below KBs:

How to Troubleshoot IPSec VPN connectivity issues 

IKEv1 VPN error logs - Troubleshooting 

IPSec and Tunneling Resource list on Configuring and Troubleshooting 

 

Regards,

Yes as @Arnesh mentioned if needed enable debug for extra info. This is also a usefull link: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcKCAS

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!