checking reason of tunnel being down in prisma sase

[Daniel_Itenberg]

Hi all,

I have a prisma sase instance, which i tried to connect via a service connection to our azure cloud tenant. We do so in conjunction with setting up global protect as our always on vpn so that users will be able to access azure/365 resources via the prisma.

Currently our tunnel is down(dosent impact users since we are still using the old vpn we have) and i cant for the life of me find the reason for it being down. documentation didn't offer help.

any help will bee appreciated, and tell me if i need to share more information. 

[nikoolayy1]

You just need to be the Responder in a VPN tunnel to see more details as Prisma Access by default is the Responder ( you can see my article https://live.paloaltonetworks.com/t5/general-articles/prisma-access-sase-extra-security-tips-and-fea... ) just check on Panorama the System logs in the GUI that Prisma Access sends to Panorama or the Cloud GUI (if you are using prisma access without Panorama).

The only thing you can't when Prisma Access is the responder is to enable ike debug as this posssible for on-prem firewalll when they are the responder:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcKCAS

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PORsCAO