Palo alto networks vpn stuck phase 1 after reboot

GwID Name Peer Address/ID Local Address/ID Protocol ProposalsДЎ0 GW-1 1.1.1.1(ipaddr:1.1.1.1) 2.2.2.2(ipaddr:2.2.2.2) Main 300-sec show vpn tunnel Use the following CLI command to show VPN gateway:

Return debug level to normal after troubleshootingДЇor issue 1: Configure an allocated IP address on the IPSec tunnel, or disable tunnel monitoring if not needed.ДЇor issue 2: Configure Proxy-ID for corresponding tunnel IP address and IP address being monitored, or disable tunnel monitoring if not needed.ДЇor issue 3: Check rekey interval on IKE Phase1 and IKE Phase2.To verify on the Palo Alto Networks firewall use the following CLI commands: This is true if rekey interval is very short and there are multiple Proxy-ID pairs. It is possible this is not an issue and that Palo Alto Networks firewall is just logging normal rekey for multiple tunnels.Note: There is no need for Proxy-ID for tunnel to tunnel IP Address Tunnel Monitoring between Palo Alto Networks firewall. For Access Control List (ACL) based IPSec VPN, Proxy-ID pair for the corresponding tunnel IP address and IP address being monitored is needed. Tunnel Monitoring is enabled while there is no corresponding Proxy-ID for the tunnel IP address and IP address being monitored.

Tunnel monitoring use the tunnel IP address as source of tunnel monitoring ICMP packets.

Tunnel Monitoring is enabled while there is no IP address configured on the tunnel.

There are three possible causes to this issue: There is site-to-site IPSec excessive rekeying on one tunnel on system logs, while other tunnels are not duplicating this behavior.

Palo alto networks vpn stuck phase 1 after reboot